Fingerprint filter questions: is fingerprint source sensitive to different data types? does it include the field name when calculating fingerprint?

Elastic Stack Logstash
1

first question:
If I use a source with 2 field value of different data type (1 string field and 1 integer field) and a source with 2 string field value but same content, will it output different fingerprint?

second question:
does fingerprint also calculates the field name, or is it just field value?

2

According to the documentation, if concatenate_sources or concatenate_all_fields is set then "the plugin concatenates the names and values of all fields given in the source option into one string". The code is here.

If you are not using concatentate then the filter will call .to_s on the data (and .force_encoding("UTF-8")) so yes, I would expect string and integer fields with the same value to produce the same fingerprint. Example code here.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.