Integrity issue between Winlogbeat and Logstash (Fingerprint)


I'm trying to test the integrity between winlogbeat and logstash with the fingerprint module.

But when i saw the log from Kibana those two fingerprint (hash) are different.

My logstash configuration:

filter {
    fingerprint {
        source => "message"
        method => "SHA256"
        target => "fingerprint-check"

My winlogbeat.yml configuration:

    - fingerprint:
        fields: ["message"]
        method: sha256

When i make a hash of the field "Message" with the function sha256sum (debian), i have an another hash different from the two fingerprint got by logstash and winlogbeat.

Is the field ("Message" or other one) is modified between winlogbeat and logstash ? or is there a problem from my configuration ?


We've opened an issue for this.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.