# How to fingerprint with a removed field?

**URL:** <https://discuss.elastic.co/t/how-to-fingerprint-with-a-removed-field/284282>\
**Category:** Logstash\
**Created:** [September 15, 2021, 12:34pm UTC](https://discuss.elastic.co/t/how-to-fingerprint-with-a-removed-field/284282 "2021-09-15T12:34:24Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Busra\_Duygu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/busra_duygu/32/90462_2.png) [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\
**Post date:** [September 15, 2021, 12:34pm UTC](https://discuss.elastic.co/t/how-to-fingerprint-with-a-removed-field/284282/1 "2021-09-15T12:34:24Z")

</div>

Hello friends, I want to put a field in a @metadata variable and use this field for fingerprinting later in logstash conf file. Is it possible for me to do this?Does anyone have an idea?  
I made some attempts but no results. :

```auto
Filter{
  csv{        
        autodetect_column_names => "true"
        separator => ","
        skip_header => "true"
        columns => ["name","surname","age","email","phone"]
    }
    mutate { 
          add_field => ["[@metadata][no_show]" => "%{[fields][name]}"]
          remove_field =>["name"]
    }
    fingerprint {
      method => "SHA1"
      source => [%{[@metadata][no_show]}]
      target => "fingerprint"
    }
}

```

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [September 15, 2021, 12:42pm UTC](https://discuss.elastic.co/t/how-to-fingerprint-with-a-removed-field/284282/2 "2021-09-15T12:42:30Z")

</div>

That should be like this

```auto
Filter{
  csv{        
        autodetect_column_names => "true"
        separator => ","
        skip_header => "true"
        columns => ["name","surname","age","email","phone"]
    }
    mutate { 
          add_field => ["[@metadata][no_show]" => "%{[fields][name]}"]
          remove_field =>["name"]
    }
    fingerprint {
      method => "SHA1"
      source => ["[@metadata][no_show]"]
      target => "fingerprint"
    }
}

```

---

<div class="post-metadata">

**Author:** ![Busra\_Duygu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/busra_duygu/32/90462_2.png) [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\
**Post date:** [September 15, 2021, 2:53pm UTC](https://discuss.elastic.co/t/how-to-fingerprint-with-a-removed-field/284282/3 "2021-09-15T14:53:31Z")

</div>

I tried that too but it doesn't work.

---

<div class="post-metadata">

**Author:** ![Busra\_Duygu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/busra_duygu/32/90462_2.png) [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\
**Post date:** [September 15, 2021, 2:55pm UTC](https://discuss.elastic.co/t/how-to-fingerprint-with-a-removed-field/284282/4 "2021-09-15T14:55:11Z")

</div>

Actually what i need is how can i put a field inside a variable. It would be silly to do this with add\_field. But I don't know any other method.

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [September 15, 2021, 2:59pm UTC](https://discuss.elastic.co/t/how-to-fingerprint-with-a-removed-field/284282/5 "2021-09-15T14:59:03Z")

</div>

You can use ony fingerprint filter for this, as per my understanding, you want to anonymize some fields :  
Example : Replace name with the anonymized value, is that right ?

```auto
 fingerprint {
      method => "SHA1"
      source => ["name"]
      target => "name"
    }

```

---

<div class="post-metadata">

**Author:** ![Busra\_Duygu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/busra_duygu/32/90462_2.png) [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\
**Post date:** [September 17, 2021, 6:51am UTC](https://discuss.elastic.co/t/how-to-fingerprint-with-a-removed-field/284282/6 "2021-09-17T06:51:25Z")

</div>

I don't think we need to write a name in the target part. Just in case, I tried that too, but it didn't work.

---

<div class="post-metadata">

**Author:** ![Busra\_Duygu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/busra_duygu/32/90462_2.png) [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\
**Post date:** [October 5, 2021, 8:02am UTC](https://discuss.elastic.co/t/how-to-fingerprint-with-a-removed-field/284282/7 "2021-10-05T08:02:56Z")

</div>

yes it's rigth. I want to put the name field in a variable and then delete it. I dont want the name to appear in the \_source block, but I want to do the fingerprint process with the name field.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 2, 2021, 8:03am UTC](https://discuss.elastic.co/t/how-to-fingerprint-with-a-removed-field/284282/8 "2021-11-02T08:03:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.