Fingerprint plugin not working

Elastic Stack Logstash
1

My filter.conf

filter {

  prune {
     whitelist_names => ["^http_user$"]
   }

   mutate {
     rename => { "http_user" => "username" }
     add_field => [ 'custom_id', '0' ]
   }

  fingerprint {
    key => "somekey"
    base64encode => true
    method => "SHA512"
    source => [ "http_user" ]
    target =>  "custom_id"
   }

}

and my output.conf

output {

    elasticsearch {
      hosts => ["elasticsearch:9200"]
      index => "my_index_name"
    }

    stdout {
      codec => rubydebug
    }

}

In stdout all entries are printed (however the custom_id remains 0 and that's why only one entry makes it to elasticsearch

2

You have changed the name of the http_user field before trying to use it.

1 Like
3

thx!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.