# Fingerprint does not work as expected

**URL:** <https://discuss.elastic.co/t/fingerprint-does-not-work-as-expected/51550>\
**Category:** Elasticsearch\
**Created:** [June 1, 2016, 11:56am UTC](https://discuss.elastic.co/t/fingerprint-does-not-work-as-expected/51550 "2016-06-01T11:56:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Swen](https://avatars.discourse-cdn.com/v4/letter/s/e8c25b/32.png) [@Swen](https://discuss.elastic.co/u/Swen)\
**Post date:** [June 1, 2016, 11:56am UTC](https://discuss.elastic.co/t/fingerprint-does-not-work-as-expected/51550/1 "2016-06-01T11:56:07Z")

</div>

I want to use a fingerprint to this into the document\_id.

fingerprint {  
key =\> "78787878"  
method =\> "SHA1"  
}

I expect this to make a hash from my 'message' and to see a 'fingerprint' variable with the hash in the output. That is not the case. I played around allot.

Only way to get it work is:

fingerprint {  
key =\> "78787878"  
method =\> "SHA1"  
concatenate\_sources =\> true  
}

Then I finally see a fingerprint with a hash in the output. BUT. It's the same for all events although the 'message' is definitely distinguished.

My whole filter is this:

filter {  
split {  
field =\> "mail"  
}

```
 fingerprint {
    key => "78787878"
    method => "SHA1"
    concatenate_sources => true
  }        

```

mutate {  
add\_field =\> {  
"log\_domain" =\> "cio"  
"log\_component" =\> "disflower\_input\_test6"  
}  
}  
}

What's wrong here?

I'm using logstash 2.3.2

---

<div class="post-metadata">

**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\
**Post date:** [June 1, 2016, 12:51pm UTC](https://discuss.elastic.co/t/fingerprint-does-not-work-as-expected/51550/2 "2016-06-01T12:51:03Z")

</div>

Hi,

this looks like a logstash question to me, you should probably ask this question there [https://discuss.elastic.co/c/logstash](https://discuss.elastic.co/c/logstash).

---

<div class="post-metadata">

**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\
**Post date:** [June 1, 2016, 3:43pm UTC](https://discuss.elastic.co/t/fingerprint-does-not-work-as-expected/51550/3 "2016-06-01T15:43:59Z")

</div>

Continued here [[Solved] Fingerprint does not work as expected II](https://discuss.elastic.co/t/fingerprint-does-not-work-as-expected-ii/51560)

---

<div class="post-metadata">

**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\
**Post date:** [June 1, 2016, 3:44pm UTC](https://discuss.elastic.co/t/fingerprint-does-not-work-as-expected/51550/4 "2016-06-01T15:44:24Z")

</div>