[filebeat] Add base64Decode template functions to httpjson

CHANGELOG.next.asciidoc

@@ -759,6 +759,7 @@ for a few releases. Please use other tools provided by Elastic to fetch data fro
 - Move processing to ingest node for AWS vpcflow fileset. {pull}28168[28168]
 - Release zoom module as GA. {pull}28106[28106]
 - Add support for secondary object attribute handling in ThreatIntel MISP module {pull}28124[28124]
+- Add `base64Decode` and `base64DecodeNoPad` functions to `httpsjon` templates. {pull}28385[28385]
 
 *Heartbeat*
 

x-pack/filebeat/docs/inputs/input-httpjson.asciidoc

@@ -201,6 +201,8 @@ Some built-in helper functions are provided to work with the input state inside
 - `hmac`: calculates the hmac signature of a list of strings concatenated together. Returns a hex encoded signature. Supports sha1 or sha256. Example `[[hmac "sha256" "secret" "string1" "string2" (formatDate (now) "RFC1123")]]`
 - `base64Encode`: Joins and base64 encodes all supplied strings. Example `[[base64Encode "string1" "string2"]]`
 - `base64EncodeNoPad`: Joins and base64 encodes all supplied strings without padding. Example `[[base64EncodeNoPad "string1" "string2"]]`
+- `base64Decode`: Decodes the base64 string. Any binary output will be converted to a UTF8 string.
+- `base64DecodeNoPad`: Decodes the base64 string without padding. Any binary output will be converted to a UTF8 string.
 - `join`: joins a list using the specified separator. Example: `[[join .body.arr ","]]`
 - `sprintf`: formats according to a format specifier and returns the resulting string. Refer to https://pkg.go.dev/fmt#Sprintf[the Go docs] for usage. Example: `[[sprintf "%d:%q" 34 "quote this"]]`
 - `hmacBase64`: calculates the hmac signature of a list of strings concatenated together. Returns a base64 encoded signature. Supports sha1 or sha256. Example `[[hmac "sha256" "secret" "string1" "string2" (formatDate (now) "RFC1123")]]`

x-pack/filebeat/input/httpjson/value_tpl.go

@@ -60,6 +60,8 @@ func (t *valueTpl) Unpack(in string) error {
 			"hmac":                hmacStringHex,
 			"base64Encode":        base64Encode,
 			"base64EncodeNoPad":   base64EncodeNoPad,
+			"base64Decode":        base64Decode,
+			"base64DecodeNoPad":   base64DecodeNoPad,
 			"join":                join,
 			"sprintf":             fmt.Sprintf,
 			"hmacBase64":          hmacStringBase64,
@@ -271,17 +273,27 @@ func base64EncodeNoPad(values ...string) string {
 	return base64.RawStdEncoding.EncodeToString([]byte(data))
 }
 
-func hmacString(hmacType string, hmacKey string, data string) []byte {
+func base64Decode(enc string) string {
+	dec, _ := base64.StdEncoding.DecodeString(enc)
+	return string(dec)
+}
+
+func base64DecodeNoPad(enc string) string {
+	dec, _ := base64.RawStdEncoding.DecodeString(enc)
+	return string(dec)
+}
+
+func hmacString(hmacType string, hmacKey []byte, data string) []byte {
 	if data == "" {
 		return nil
 	}
 	// Create a new HMAC by defining the hash type and the key (as byte array)
 	var mac hash.Hash
 	switch hmacType {
 	case "sha256":
-		mac = hmac.New(sha256.New, []byte(hmacKey))
+		mac = hmac.New(sha256.New, hmacKey)
 	case "sha1":
-		mac = hmac.New(sha1.New, []byte(hmacKey))
+		mac = hmac.New(sha1.New, hmacKey)
 	default:
 		// Upstream config validation prevents this from happening.
 		return nil
@@ -298,7 +310,7 @@ func hmacStringHex(hmacType string, hmacKey string, values ...string) string {
 	if data == "" {
 		return ""
 	}
-	bytes := hmacString(hmacType, hmacKey, data)
+	bytes := hmacString(hmacType, []byte(hmacKey), data)
 	// Get result and encode as hexadecimal string
 	return hex.EncodeToString(bytes)
 }
@@ -308,7 +320,7 @@ func hmacStringBase64(hmacType string, hmacKey string, values ...string) string
 	if data == "" {
 		return ""
 	}
-	bytes := hmacString(hmacType, hmacKey, data)
+	bytes := hmacString(hmacType, []byte(hmacKey), data)
 
 	// Get result and encode as hexadecimal string
 	return base64.StdEncoding.EncodeToString(bytes)

x-pack/filebeat/input/httpjson/value_tpl_test.go

@@ -367,6 +367,21 @@ func TestValueTpl(t *testing.T) {
 			expectedVal:   "",
 			expectedError: errEmptyTemplateResult.Error(),
 		},
+		{
+			name:        "func base64Decode 2 strings",
+			value:       `[[base64Decode "c3RyaW5nMXN0cmluZzI="]]`,
+			paramCtx:    emptyTransformContext(),
+			paramTr:     transformable{},
+			expectedVal: "string1string2",
+		},
+		{
+			name:          "func base64Decode no value",
+			value:         `[[base64Decode ""]]`,
+			paramCtx:      emptyTransformContext(),
+			paramTr:       transformable{},
+			expectedVal:   "",
+			expectedError: errEmptyTemplateResult.Error(),
+		},
 	}
 
 	for _, tc := range cases {