# Logstash fingerprint hash everything

**URL:** <https://discuss.elastic.co/t/logstash-fingerprint-hash-everything/77827>\
**Category:** Logstash\
**Created:** [March 8, 2017, 2:05pm UTC](https://discuss.elastic.co/t/logstash-fingerprint-hash-everything/77827 "2017-03-08T14:05:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Exocomp](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Exocomp](https://discuss.elastic.co/u/Exocomp)\
**Post date:** [March 8, 2017, 2:05pm UTC](https://discuss.elastic.co/t/logstash-fingerprint-hash-everything/77827/1 "2017-03-08T14:05:05Z")

</div>

Is there a way with the fingerprint filter to hash every field into one hash value?

```
		fingerprint {
		method => "SHA1"
		source => ["myfield1", "myfield2"]
                    concatenate_sources => true
	}

```

By default fingerprint uses message as the source, however if message is not present you have to specify the source field, see above example. The problem here is that if the fields change then you no longer get a valid hash of everything. There is a **concatenate\_sources** property but that works with the hard coded source fields.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 9, 2017, 6:51pm UTC](https://discuss.elastic.co/t/logstash-fingerprint-hash-everything/77827/2 "2017-03-09T18:51:38Z")

</div>

Yeah, there's no option to fingerprint all fields. As a workaround you should be able to use a ruby filter to concatenate all fields and then you can fingerprint _that_ field.

---

<div class="post-metadata">

**Author:** ![Exocomp](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Exocomp](https://discuss.elastic.co/u/Exocomp)\
**Post date:** [March 9, 2017, 7:03pm UTC](https://discuss.elastic.co/t/logstash-fingerprint-hash-everything/77827/3 "2017-03-09T19:03:14Z")

</div>

@magnusbaeck

Thanks for confirming, that is what I ended up doing.

E

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 6, 2017, 7:03pm UTC](https://discuss.elastic.co/t/logstash-fingerprint-hash-everything/77827/4 "2017-04-06T19:03:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.