logstash base64解码字段

需求场景：需要base64解码filebeat上传的某个字段，然后es方便做聚合

filter { 
    grok {
        match => {            "message" => "%{DATA:mark}&%{DATA:time}&%{WORD:app}&%{DATA:version}&%{DATA:deviceid}&%{DATA:channel}&%{DATA:uid}&%{INT:types}&%{DATA:position}&%{DATA:environment}&%{DATA:operator}&%{DATA:sysinfo}&%{GREEDYDATA:msg}"
        } 
        remove_field => ['type','_id','input_type','tags','message','beat','source','offset']
    }
    if [types] in ['1','2','3','4','5'] {
        ruby {
            init => "require 'base64'"
            code => "event['b64_decoded'] = Base64.decode64(event['msg']) if event.include?('msg')"     #这里解码出刚刚截取出来的msg字段
        }
        json {
            source => "b64_decoded"                            #因为b64_decoded解码出来json，需要继续进行解析
            remove_field => ['b64_decoded']
        }
    }
}

参考文档： https://gist.github.com/bfritz/7831984#file-ruby_filter_base64_decode_example-sh-L15