[Solved] Fingerprint does not work as expected II

Elastic Stack Logstash
1

I want to use a fingerprint to put it into the document_id.

fingerprint {
key => "78787878"
method => "SHA1"
}

I expect this to make a hash from my 'message' and to see a 'fingerprint' variable with the hash in the output. That is not the case. I played around allot.

Only way to get it work is:

fingerprint {
key => "78787878"
method => "SHA1"
concatenate_sources => true
}

Then I finally see a fingerprint with a hash in the output. BUT. It's the same for all events although the 'message' is definitely distinguished.

My whole filter is this:

filter {
split {
field => "mail"
}
fingerprint {
key => "78787878"
method => "SHA1"
concatenate_sources => true
}

mutate {
add_field => {
"log_domain" => "cio"
"log_component" => "disflower_input_test6"
}
}
}

What's wrong here?

I'm using logstash 2.3.2

2

It works just fine for me. Do you have the default 'message' field available when you invoke the fingerprint filter? What does the resulting event look like if you output it to stdout using the rubydebug codec?

3

Output looks like this:

   "@version" => "1",
   "@timestamp" => "2016-06-01T14:35:35.579Z",
   "host" => "WPNLL0037485",
   "command" => "C:\\Data\\INGteststraat\\TestEngine\\LogStashLib\\RequestRest\\bin\\Debug\\RequestRest.exe",
   "log_domain" => "cio",
"log_component" => "disflower_input_test6"
4

Update:

This works. But only this. "Message" does not work.

fingerprint {
source => [ "@timestamp" ]
key => "78787878"
}

5

There does not seem to be any message field, so you will need to specify the field(s) to use for the fingerprint using the source parameter.

6

You should be able to specify multiple fields in the source array as long as you also enable concatenate_sources.

It would be useful if it automatically concatenated sources if you provide an array.

7

You are right. It's working. I was thinking that I Always have a 'message' variable.