URL Decode

Parse Elastic Compatible

Synopsis

Decodes URL-encoded strings back to their original form.

Schema

url_decode:
  - field: <ident>
  - description: <text>
  - if: <script>
  - ignore_failure: <boolean>
  - ignore_missing: <boolean>
  - on_failure: <processor[]>
  - on_success: <processor[]>
  - tag: <string>
  - target_field: <ident>

Configuration

Field	Required	Default	Description
field	Y	-	Field containing the encoded URL(s)
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	See Handling Failures
ignore_missing	N	false	If true, quietly exit if field doesn't exist
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier
target_field	N	field	Field to store the decoded value(s)

Details

The processor can handle both single strings and arrays of strings, decoding percent-encoded characters and converting '+' signs back to spaces.

warning

If the field contains non-string values, the processor will fail unless ignore_failure is set to true.

note

The processor uses Go's url.QueryUnescape function which follows standard URL decoding rules, including converting '+' signs in query strings back to spaces.

warning

Decoded output might contain special characters or potentially malicious content. Consider appropriate validation and sanitization after decoding.

Examples

Single URL

Decoding a URL with encoded spaces and special characters...	{ "url": "https://example.com/path?query=test%20data" } url_decode: - field: url
converts percent-encoded characters:	{ "url": "https://example.com/path?query=test data" }

Multiple URLs

Processing an array of encoded URLs...	{ "urls": [ "https://example.com/path?query=test%20data", "http://site.com/?key=value%26data%3D123" ] } url_decode: - field: urls
decodes each element:	{ "urls": [ "https://example.com/path?query=test data", "http://site.com/?key=value&data=123" ] }

Target Field

Storing the decoded URL in a new field...	{ "encoded_url": "https://example.com/search?q=hello%2Bworld" } url_decode: - field: encoded_url - target_field: decoded_url
preserves the original:	{ "encoded_url": "https://example.com/search?q=hello%2Bworld", "decoded_url": "https://example.com/search?q=hello+world" }