Logstash fingerprint hash everything

Elastic Stack Logstash
1

Is there a way with the fingerprint filter to hash every field into one hash value?

		fingerprint {
		method => "SHA1"
		source => ["myfield1", "myfield2"]
                    concatenate_sources => true
	}

By default fingerprint uses message as the source, however if message is not present you have to specify the source field, see above example. The problem here is that if the fields change then you no longer get a valid hash of everything. There is a concatenate_sources property but that works with the hard coded source fields.

2

Yeah, there's no option to fingerprint all fields. As a workaround you should be able to use a ruby filter to concatenate all fields and then you can fingerprint that field.

3

@magnusbaeck

Thanks for confirming, that is what I ended up doing.

E

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.