How to fingerprint with a removed field?

Elastic Stack Logstash
1

Hello friends, I want to put a field in a @metadata variable and use this field for fingerprinting later in logstash conf file. Is it possible for me to do this?Does anyone have an idea?
I made some attempts but no results. :

Filter{
  csv{        
        autodetect_column_names => "true"
        separator => ","
        skip_header => "true"
        columns => ["name","surname","age","email","phone"]
    }
    mutate { 
          add_field => ["[@metadata][no_show]" => "%{[fields][name]}"]
          remove_field =>["name"]
    }
    fingerprint {
      method => "SHA1"
      source => [%{[@metadata][no_show]}]
      target => "fingerprint"
    }
}
2

That should be like this

Filter{
  csv{        
        autodetect_column_names => "true"
        separator => ","
        skip_header => "true"
        columns => ["name","surname","age","email","phone"]
    }
    mutate { 
          add_field => ["[@metadata][no_show]" => "%{[fields][name]}"]
          remove_field =>["name"]
    }
    fingerprint {
      method => "SHA1"
      source => ["[@metadata][no_show]"]
      target => "fingerprint"
    }
}
3

I tried that too but it doesn't work.

4

Actually what i need is how can i put a field inside a variable. It would be silly to do this with add_field. But I don't know any other method.

5

You can use ony fingerprint filter for this, as per my understanding, you want to anonymize some fields :
Example : Replace name with the anonymized value, is that right ?

 fingerprint {
      method => "SHA1"
      source => ["name"]
      target => "name"
    }
6

I don't think we need to write a name in the target part. Just in case, I tried that too, but it didn't work.

7

yes it's rigth. I want to put the name field in a variable and then delete it. I dont want the name to appear in the _source block, but I want to do the fingerprint process with the name field.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.