Encoding operators

FuseQL encoding operators encode, decode, and hash string values. Use them to handle base64 payloads, URL-encoded strings, and anonymised field values.

base64decode

Converts a base64-encoded string into its original ASCII or UTF-8 representation. Use base64decode to reverse base64 encoding found in log fields — for example, decoding encoded credentials, tokens, or payloads captured in application logs.

Syntax

| base64decode(<base64String>) as <alias>
none

Parameters

Parameter Required Description

<base64String>

Required

A base64-encoded string field or literal to decode.

<alias>

Required

Name for the resulting field.

Example

Decode a known base64-encoded HTTP method string to verify the original value.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| base64encode(method) as method_b64
| base64decode(method_b64) as method_decoded
| first(method_decoded) by method
Expected output
method first(method_decoded)

GET

GET

POST

POST

HEAD

HEAD

Providing an invalid base64 string returns an error or empty result. Use base64decode paired with base64encode to round-trip field values and verify encoding fidelity.

base64encode

Converts an ASCII or UTF-8 string to its base64-encoded representation. Use base64encode to safely encode binary or special-character data for transport or storage — for example, encoding HTTP method names or field values before embedding them in headers or structured outputs.

Syntax

| base64encode(<string>) as <alias>
none

Parameters

Parameter Required Description

<string>

Required

A string field or literal to encode as base64.

<alias>

Required

Name for the resulting field.

Example

Encode the HTTP method field and count unique encoded values.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| base64encode(method) as method_b64
| count by method_b64
Expected output
method_b64 decoded _count

R0VU

GET

3,091

UE9TVA==

POST

2,159,649

SEVBRA==

HEAD

183

Results are confirmed from a 5-minute nginx log window. The decoded column is shown for reference only — it is not produced by the query.

hash

Hashes a field value into a fixed-length string using a specified algorithm. Use hash to anonymize sensitive fields — such as IP addresses or user identifiers — while still allowing grouping and cardinality counting without exposing the original values. The default algorithm is MD5; SHA1, SHA2-256, and MurmurHash3 are also supported.

Syntax

| hash(<field>) as <alias>

| hash(<field>, <hashAlgorithm>) as <alias>
none

where <hashAlgorithm> is one of: md5 (default), sha1, sha2_256, murmur3_128.

Parameters

Parameter Required Description

<field>

Required

The string field or literal to hash.

<hashAlgorithm>

Optional

The hash algorithm to use. Defaults to md5. Supported values: md5, sha1, sha2_256, murmur3_128.

<alias>

Required

Name for the resulting hash field.

Example

Hash client IP addresses using the default MD5 algorithm and count the number of unique hashed IPs to measure distinct client cardinality without exposing real addresses.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| hash(ip) as ip_hash
| count_unique(ip_hash) as unique_ips
Expected output
unique_ips

1,167

Result is confirmed from a 5-minute nginx log window. Use sha1 or sha2_256 for stronger hash guarantees; use murmur3_128 for higher performance when cryptographic strength is not required.

urldecode

Decodes a percent-encoded URL string by replacing %XX escape sequences with their original characters. Use urldecode when log fields contain percent-encoded URLs or query parameters that need to be read in plain text for analysis or grouping.

Syntax

| urldecode(<urlString>) as <alias>
none

Parameters

Parameter Required Description

<urlString>

Required

A percent-encoded string field or literal to decode.

<alias>

Required

Name for the resulting field.

Example

Decode a percent-encoded URL string and return the plain-text result.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| urlencode(url) as url_encoded
| urldecode(url_encoded) as url_decoded
| first(url_decoded) by method
Expected output
method first(url_decoded)

GET

/ingester/health/ HTTP/2.0

POST

/ingester/otlp/v1/logs HTTP/2.0

Values shown are illustrative; actual results depend on your log data. Providing a string that is not percent-encoded returns the string unchanged.

urlencode

Percent-encodes a string so that special characters are replaced with their %XX ASCII equivalents, making the string safe for use in a URL. Use urlencode to sanitize field values before embedding them in URLs or query strings — for example, encoding paths or parameters extracted from log lines.

Syntax

| urlencode(<string>) as <alias>
none

Parameters

Parameter Required Description

<string>

Required

A string field or literal to percent-encode.

<alias>

Required

Name for the resulting field.

Example

Percent-encode the parsed URL field (which includes spaces and slashes in the protocol token) and return the first encoded value per method.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| urlencode(url) as url_encoded
| first(url_encoded) by method
Expected output
method first(url_encoded)

GET

/ingester/health/%20HTTP%2F2.0

POST

/ingester/otlp/v1/logs%20HTTP%2F2.0

Values shown are illustrative; actual results depend on your log data. Spaces are encoded as %20 and forward slashes as %2F. Use urldecode to reverse the encoding.