# Enabling fingerprint file\_identiy

**URL:** <https://discuss.elastic.co/t/enabling-fingerprint-file-identiy/347780>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 22, 2023, 5:37pm UTC](https://discuss.elastic.co/t/enabling-fingerprint-file-identiy/347780 "2023-11-22T17:37:45Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![MajorNickle](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@MajorNickle](https://discuss.elastic.co/u/MajorNickle)\
**Post date:** [November 22, 2023, 5:37pm UTC](https://discuss.elastic.co/t/enabling-fingerprint-file-identiy/347780/1 "2023-11-22T17:37:45Z")

</div>

Hey all,

I'm stuck with getting the fingerprint file\_identity working. I have a few nfs mounts from which I'm reading log files. I tried enabling the fingerprint option in the scanner but it seems like it's not really being applied. I'm suspecting this cause when I run filebeat then unmount a share and remount it's again reading the log from the very beginning. I would expect it to identify it by the hash it generates from the first 0-1024 bytes correct? Is there any way to see if fingerprint is enabled and running within the filebeat logs?

Below is a snippet from my config file.

```auto
- type: filestream
  id: my-filestream-id
  enabled: true
  paths:
    - /my/path/*/log/access.log
  prospector.scanner.fingerprint.enabled: true
  prospector.scanner.fingerprint.offset: 0
  prospector.scanner.fingerprint.length: 1024
  file_identity.fingerprint: ~

```

Thanks for any help in advance!  
F

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 22, 2023, 5:49pm UTC](https://discuss.elastic.co/t/enabling-fingerprint-file-identiy/347780/2 "2023-11-22T17:49:52Z")

</div>

If I'm not wrong you also need to configure the `file_identity` to tell that it will use the _fingerprint_ method.

From the [documentation](https://www.elastic.co/guide/en/beats/filebeat/8.10/filebeat-input-filestream.html#_file_identity_2) you would need add this to your input:

```auto
file_identity.fingerprint: ~

```

---

<div class="post-metadata">

**Author:** ![MajorNickle](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@MajorNickle](https://discuss.elastic.co/u/MajorNickle)\
**Post date:** [November 22, 2023, 5:59pm UTC](https://discuss.elastic.co/t/enabling-fingerprint-file-identiy/347780/3 "2023-11-22T17:59:41Z")

</div>

> [@leandrojmp](#):
>
> If I'm not wrong you also need to configure the `file_identity` to tell that it will use the _fingerprint_ method.

Sorry I did have that line already in my config just forgot to add it above. With that option set it's still reading the log from the beginning everytime I remount the share.

---

<div class="post-metadata">

**Author:** ![MajorNickle](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@MajorNickle](https://discuss.elastic.co/u/MajorNickle)\
**Post date:** [November 22, 2023, 9:24pm UTC](https://discuss.elastic.co/t/enabling-fingerprint-file-identiy/347780/4 "2023-11-22T21:24:32Z")

</div>

Ok after reinstalling filebeat on my hosts I now can see registry entries in `/var/lib/filebeat/registry/filebeat/log.json`. It seems to do the fingerprint and also store the offset. However when I umount and mount the share, it's still reading the log from the beginning. What am I missing here? The fingerprint seems to stay the same. Below are some line from the above log.json file.

**Before umount**

```auto
{
    "k":"filestream::my-filestream-id::fingerprint::97f35983dad82bc9deea3b3c5f496fca99bbb1427144835ccaf2f81e26d71239",
    "v":{
        "ttl":1800000000000,
        "updated":[279413623333240,1700687491],
        "cursor":{"offset":4078955},
        "meta":{
            "source":"/my/path/device01/log/access.log",
            "identifier_name":"fingerprint"
        }
    }
}

```

**After mount**

```auto
{
    "k":"filestream::my-filestream-id::fingerprint::97f35983dad82bc9deea3b3c5f496fca99bbb1427144835ccaf2f81e26d71239",
    "v":{
        "ttl":1800000000000,
        "updated":[279413860450242,1700687642],
        "cursor":{"offset":4078955},
        "meta":{
            "source":"/my/path/device01/log/access.log",
            "identifier_name":"fingerprint"
        }
    }
}

```

---

<div class="post-metadata">

**Author:** ![MajorNickle](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@MajorNickle](https://discuss.elastic.co/u/MajorNickle)\
**Post date:** [November 23, 2023, 3:55pm UTC](https://discuss.elastic.co/t/enabling-fingerprint-file-identiy/347780/5 "2023-11-23T15:55:09Z")

</div>

After setting `clean_remove` to false this works as expected.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 21, 2023, 5:55pm UTC](https://discuss.elastic.co/t/enabling-fingerprint-file-identiy/347780/6 "2023-12-21T17:55:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.