Thank you @badger for the update.
filter {
fingerprint {
method => "SHA1"
target => "fingerprint"
source => ["user_id", "siblings", "birthday"]
}
}
If user_id is used in source field. then should that field be present.
What I mean is in my case the json parse field name user_id should be present to calculate the HASH value.