Logstash fingerprint hash everything

Is there a way with the fingerprint filter to hash every field into one hash value?

		fingerprint {
		method => "SHA1"
		source => ["myfield1", "myfield2"]
                    concatenate_sources => true

By default fingerprint uses message as the source, however if message is not present you have to specify the source field, see above example. The problem here is that if the fields change then you no longer get a valid hash of everything. There is a concatenate_sources property but that works with the hard coded source fields.

Yeah, there's no option to fingerprint all fields. As a workaround you should be able to use a ruby filter to concatenate all fields and then you can fingerprint that field.


Thanks for confirming, that is what I ended up doing.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.