Fingerprint does not work as expected

Elastic Stack Elasticsearch
1

I want to use a fingerprint to this into the document_id.

fingerprint {
key => "78787878"
method => "SHA1"
}

I expect this to make a hash from my 'message' and to see a 'fingerprint' variable with the hash in the output. That is not the case. I played around allot.

Only way to get it work is:

fingerprint {
key => "78787878"
method => "SHA1"
concatenate_sources => true
}

Then I finally see a fingerprint with a hash in the output. BUT. It's the same for all events although the 'message' is definitely distinguished.

My whole filter is this:

filter {
split {
field => "mail"
}

 fingerprint {
    key => "78787878"
    method => "SHA1"
    concatenate_sources => true
  }

mutate {
add_field => {
"log_domain" => "cio"
"log_component" => "disflower_input_test6"
}
}
}

What's wrong here?

I'm using logstash 2.3.2

2

Hi,

this looks like a logstash question to me, you should probably ask this question there https://discuss.elastic.co/c/logstash.

3

Continued here [Solved] Fingerprint does not work as expected II