# Different field syntaxes between winlogbeat and logstash (fingerprint plugin)

**URL:** https://discuss.elastic.co/t/different-field-syntaxes-between-winlogbeat-and-logstash-fingerprint-plugin/234761
**Category:** Logstash
**Created:** [May 28, 2020, 2:13pm UTC](https://discuss.elastic.co/t/different-field-syntaxes-between-winlogbeat-and-logstash-fingerprint-plugin/234761 "2020-05-28T14:13:02Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![JeanN](https://avatars.discourse-cdn.com/v4/letter/j/b38774/32.png) [@JeanN](https://discuss.elastic.co/u/JeanN)
#### Post date: [May 28, 2020, 2:13pm UTC](https://discuss.elastic.co/t/different-field-syntaxes-between-winlogbeat-and-logstash-fingerprint-plugin/234761/1 "2020-05-28T14:13:02Z")

</div>

Hello,

I want to compare the fingerprint of Logstash and Winlogbeat of the same field.  
But when i provide the "field" setting from winlogbeat and after i provide the same field on the "source" setting from logstash, those fingerprint are different or there is no fingerprint from one of them (Winlogbeat or Logstash).  
I give you an example to clarify my problem:

I want to get the fingerprint of "event.original"

Winlogbeat configuration:

```auto
output.logstash:
  hosts: ["192.168.1.1:5044"]

processors:
  - fingerprint:
      fields: ["event.original"]
      method: sha256

```

Logstash configuration:

```auto
input{
  beats {
    port => 5044
  }
}

filter {
  fingerprint {
    source => ["event.original"]
    method => "SHA256"
    target => "fingerprint-check"
  }
}

output {
 elasticsearch {
    hosts => ["https://localhost:9200"]
    index => "%{[@metadata][beat]}-%{[@metadata][version]}"
    user => "user"
    password => "password"
    ssl => true
    ssl_certificate_verification => false
    cacert => '/etc/logstash/ssl/elasticsearch-ca.pem'
  }
}

```

On the Kibana Dashboards the "fingerprint-check" (fingerprint from logstash) doesn't appear while the one from winlogbeat appears on Kibana logs.

I am wondering if there is a difference between syntaxes of winlogbeat field and logstash source (that are supposed to be the same ?) .

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 28, 2020, 4:24pm UTC](https://discuss.elastic.co/t/different-field-syntaxes-between-winlogbeat-and-logstash-fingerprint-plugin/234761/2 "2020-05-28T16:24:16Z")

</div>

If event is an object that contains a field called original then in logstash that would be called [event][original], not [event.original], which in logstash refers to a field with a . in its name.

---

<div class="post-metadata">

### Author: ![JeanN](https://avatars.discourse-cdn.com/v4/letter/j/b38774/32.png) [@JeanN](https://discuss.elastic.co/u/JeanN)
#### Post date: [June 2, 2020, 1:08pm UTC](https://discuss.elastic.co/t/different-field-syntaxes-between-winlogbeat-and-logstash-fingerprint-plugin/234761/3 "2020-06-02T13:08:14Z")

</div>

Thanks for your answer @Badger.

When i use this syntax "[event][original]" in the fingerprint module from logstash like this:

```auto
filter {
  fingerprint {
    source => [event][original]
    method => "SHA256"
    target => "fingerprint-check"
  }
}

```

Any "fingerprint-check" appears on Kibana, but when i use it as a new fields with "'add\_fields" module in the same filter of fingerprint and i put this new field in fingerprint's module:

```auto
filter {
  add_fields {
    "event_field" => "%{[event][original]}"
  }
  fingerprint {
    source => [event][original]
    method => "SHA256"
    target => "fingerprint-check"
  }
}

```

On Kibana Dashboards the new field "event\_field" is exactly the same of "event.original" field from winlogbeat. But the "fingerprint-check (from logstash) doesn't appear.

I don't understand why the fingerprint module of logstash doesn't work on this field.

Thanks.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 30, 2020, 1:08pm UTC](https://discuss.elastic.co/t/different-field-syntaxes-between-winlogbeat-and-logstash-fingerprint-plugin/234761/4 "2020-06-30T13:08:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.