Fingerprint filter and concatenate_sources


I have a doubt about documentation for fingerprint filter.

regarding concatenate_sources Documentation states

"When set to true, we concatenate the values of all fields into 1 string like the old checksum filter"

But all field refers to field in source array of fingerprint filter, or field of all document/event?

It's all fields in the source field that'll get concatenated.

1 Like

Is there a way to include all fileds of a document in the fingerprint? We have only dynamic fields...



There doesn't appear to be a way to do that, I'm afraid.