EDXDecode

Learn about the EDXDecode Edge Delta OTTL extension function.

  less than a minute  

Minimum Agent Version: v2.5.0

The EDXDecode function decodes encoded strings using various encoding formats. It supports URL encoding (percent encoding) and hexadecimal encoding.

Syntax

EDXDecode(value, encoding_type)

Parameters

  • value: The encoded string to decode
  • encoding_type: The type of encoding to decode from. Supported values:
    • "url": URL/percent encoding (e.g., %20 becomes a space)
    • "hex": Hexadecimal encoding (e.g., 48656c6c6f becomes “Hello”)

Input

{
  "_type": "log",
  "timestamp": 1757000000000,
  "body": "url=https%3A%2F%2Fapi.example.com%2Fpath%3Fquery%3Dvalue&message=Hello%20World%21",
  "resource": {...},
  "attributes": {
    "hex_data": "4564676544656c7461"
  }
}

Example

// Parse the body to extract key-value pairs
set(attributes["kv_map"], ParseKeyValue(body))

// Decode URL encoded values
set(attributes["decoded_url"], EDXDecode(attributes["kv_map"]["url"], "url"))
set(attributes["decoded_message"], EDXDecode(attributes["kv_map"]["message"], "url"))

// Decode hex encoded value
set(attributes["decoded_hex"], EDXDecode(attributes["hex_data"], "hex"))

Output

{
  "_type": "log",
  "timestamp": 1757000000000,
  "body": "url=https%3A%2F%2Fapi.example.com%2Fpath%3Fquery%3Dvalue&message=Hello%20World%21",
  "resource": {...},
  "attributes": {
    "hex_data": "4564676544656c7461",
    "kv_map": {
      "url": "https%3A%2F%2Fapi.example.com%2Fpath%3Fquery%3Dvalue",
      "message": "Hello%20World%21"
    },
    "decoded_url": "https://api.example.com/path?query=value",
    "decoded_message": "Hello World!",
    "decoded_hex": "EdgeDelta"
  }
}

The EDXDecode function has decoded the URL-encoded strings (converting %3A to :, %2F to /, %20 to space, etc.) and the hexadecimal string to its ASCII representation.