Base64 Decode

Decode

Synopsis

Decodes base64-encoded strings into UTF-8 text using standard base64 encoding, compatible with Kusto's base64_decode_tostring() function.

Schema

- base64_decode:
    field: <ident>
    target_field: <ident>
    description: <text>
    disabled: <boolean>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>

Configuration

Field	Required	Default	Description
field	Y		Source field containing base64-encoded data
target_field	N	Same as field	Target field to store decoded text
description	N		Explanatory note
disabled	N	false	Disable processor execution
if	N		Condition to run
ignore_failure	N	false	Continue processing if decoding fails
ignore_missing	N	false	Skip processing if referenced field doesn't exist
on_failure	N		See Handling Failures
on_success	N		See Handling Success
tag	N		Identifier

Details

Decodes base64-encoded strings using standard base64 encoding (RFC 4648). The processor validates UTF-8 encoding of decoded output and sets the target field to null for invalid UTF-8 sequences, matching Microsoft Kusto's base64_decode_tostring() behavior.

Encoding Validation: Uses base64.StdEncoding (standard base64 alphabet with padding). Invalid base64 strings cause processor failure unless ignore_failure is enabled.

UTF-8 Handling: After successful base64 decoding, validates that the decoded bytes form valid UTF-8. If UTF-8 validation fails, sets target field to null instead of returning invalid text. This ensures decoded output contains only valid UTF-8 strings.

Target Field Behavior: When target_field is not specified, overwrites the source field with decoded result. When specified, creates a new field while preserving the original base64-encoded value.

Empty String Handling: Empty strings decode successfully to empty strings. Null field values cause failure unless ignore_missing is enabled.

Examples

Basic Base64 Decoding

Decoding base64 string to separate field...	{ "encoded": "S3VzdG8=" } - base64_decode: field: encoded target_field: decoded_message
Creates new field with decoded text...	{ "encoded": "S3VzdG8=", "decoded_message": "Kusto" }

In-Place Decoding

Decoding and replacing original field...	{ "message": "SGVsbG8gV29ybGQ=" } - base64_decode: field: message
Overwrites source field with decoded value...	{ "message": "Hello World" }

Special Characters and Unicode

Decoding text with special characters and unicode...	{ "message": "SGVsbG8g5LiW55WMIPCfjI0=" } - base64_decode: field: message target_field: decoded
Handles unicode characters correctly...	{ "message": "SGVsbG8g5LiW55WMIPCfjI0=", "decoded": "Hello 世界 🌍" }

Invalid UTF-8 Handling

Processing base64 that decodes to invalid UTF-8...	{ "message": "U3RyaW5n0KHR0tGA0L7Rh9C60LA=" } - base64_decode: field: message target_field: decoded
Sets field to null for invalid UTF-8...	{ "message": "U3RyaW5n0KHR0tGA0L7Rh9C60LA=", "decoded": null }

Error Handling with Invalid Base64

Ignoring decoding failures for invalid input...	{ "message": "Not@Valid@Base64!!!" } - base64_decode: field: message target_field: decoded ignore_failure: true
Processing continues despite invalid base64...	{ "message": "Not@Valid@Base64!!!" }

Missing Field Handling

Skipping processing when field doesn't exist...	{ "other_field": "value" } - base64_decode: field: nonexistent target_field: decoded ignore_missing: true
Processing continues without error...	{ "other_field": "value" }