Fingerprint filter concatenate_all_fields vs concatenate_sources

Elastic Stack Logstash
1

Hello, does concatenate_sources only concat field in the source option and concatenate_all_fields concat all the fields from the input, e.g.: i have a log with a,b,c,d,e fields.

If i use this,

fingerprint{
    concatenate_sources => "true"
    method => "MURMUR3_128"
    source => ["a","b"]
    target => "fingerprint"
  }

the fingerprint will use the concat of a and b only. But if I use this

fingerprint{
    concatenate_all_fields => "true"
    method => "MURMUR3_128"
    source => ["a","b"]
    target => "fingerprint"
  }

the fingerprint will use the concat of a, b, c, d, and e?

2

If you look at the code you will see that if concatenate_all_fields is set then source is ignored.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.