Integrity issue between Winlogbeat and Logstash (Fingerprint)

[JeanN (Jean)]

Hi,

I'm trying to test the integrity between winlogbeat and logstash with the fingerprint module.

But when i saw the log from Kibana those two fingerprint (hash) are different.

My logstash configuration:

filter {
    fingerprint {
        source => "message"
        method => "SHA256"
        target => "fingerprint-check"
    }
}

My winlogbeat.yml configuration:

processors:
    - fingerprint:
        fields: ["message"]
        method: sha256

When i make a hash of the field "Message" with the function sha256sum (debian), i have an another hash different from the two fingerprint got by logstash and winlogbeat.

Is the field ("Message" or other one) is modified between winlogbeat and logstash ? or is there a problem from my configuration ?

Thanks.

[andrewkroh]

We've opened an issue for this. https://github.com/elastic/beats/issues/18542