Zlib Decompress

Decode Kusto Compatible

Synopsis

Decompresses zlib-compressed data from base64-encoded strings. Compatible with Kusto's zlib_decompress_from_base64_string() function.

Schema

- zlib_decompress:
    field: <ident>
    description: <text>
    disabled: <boolean>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>
    target_field: <ident>

Configuration

Field	Required	Default	Description
field	Y		Field containing base64-encoded zlib-compressed data
description	N		Explanatory note
disabled	N	false	Disable processor execution
if	N		Condition to run
ignore_failure	N	false	See Handling Failures
ignore_missing	N	false	If true, quietly exit if field doesn't exist
on_failure	N		See Handling Failures
on_success	N		See Handling Success
tag	N		Identifier
target_field	N	field	Field to store decompressed value

Details

The processor expects base64-encoded zlib-compressed data and performs two operations: base64 decoding followed by zlib decompression. This matches the behavior of Kusto's zlib_decompress_from_base64_string() function.

When the source field contains invalid base64 data or corrupted zlib data, the processor sets the target field to an empty string rather than failing. This Kusto-compatible behavior ensures processing continues even with malformed data.

The processor handles both string and non-string values by converting non-string values to their string representation before processing.

If target_field is not specified, the decompressed value overwrites the original field. Specifying a different target_field preserves the original compressed data.

Examples

Basic Decompression

Decompressing zlib-compressed base64-encoded data...	{ "compressed": "eJwLSS0uUSguKcrMS1cwNDIGACxqBQ4=" } - zlib_decompress: field: compressed target_field: decompressed
extracts the original text:	{ "compressed": "eJwLSS0uUSguKcrMS1cwNDIGACxqBQ4=", "decompressed": "Test string 123" }

In-Place Decompression

Decompressing and replacing the original field...	{ "message": "eJwLSS0uUSguKcrMS1cwNDIGACxqBQ4=" } - zlib_decompress: field: message
overwrites the compressed value:	{ "message": "Test string 123" }

Round-Trip Processing

Compressing and then decompressing data...	{ "original": "Hello Kusto World! 1234567890" } - zlib_compress: field: original target_field: compressed - zlib_decompress: field: compressed target_field: restored
restores the original value:	{ "original": "Hello Kusto World! 1234567890", "compressed": "eJwzNDQ0MjE1M7ewsLS2sbWzdXCwd3RydgYAPjkGPw==", "restored": "Hello Kusto World! 1234567890" }

Invalid Data Handling

Processing invalid base64 or corrupted zlib data...	{ "invalid": "x0x0x0" } - zlib_decompress: field: invalid target_field: result
returns empty string on error:	{ "invalid": "x0x0x0", "result": "" }

Unicode Content

Decompressing unicode text with emojis...	{ "message": "eJxLS8zJUShOTEvLL1IICPIP8g8CAAVsCCo=" } - zlib_decompress: field: message target_field: text
preserves unicode characters:	{ "message": "eJxLS8zJUShOTEvLL1IICPIP8g8CAAVsCCo=", "text": "Hello 世界 🌍 Test" }