# Logstash Fingerprint Plugin: How to Exclude @timestamp
**URL:** https://discuss.elastic.co/t/logstash-fingerprint-plugin-how-to-exclude-timestamp/112498
**Category:** Logstash
**Created:** [December 19, 2017, 7:35pm UTC](https://discuss.elastic.co/t/logstash-fingerprint-plugin-how-to-exclude-timestamp/112498 "2017-12-19T19:35:19Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@shreyask](https://discuss.elastic.co/u/shreyask)
#### Post date: [December 19, 2017, 7:35pm UTC](https://discuss.elastic.co/t/logstash-fingerprint-plugin-how-to-exclude-timestamp/112498/1 "2017-12-19T19:35:19Z")
I am using the fingerprint plugin with the `concatenate_all_fields` option to generate a UUID for each document. I got into a situation where the content of my message does not change but since `@timestamp` is integral part of the message it creates a UUID and kind of defeats the purpose of the UUID.
I was wondering what would be a good way to work around this situation and exclude `@timestamp` for the fingerprint step, any help or tips would be greatly appreciated.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 19, 2017, 7:53pm UTC](https://discuss.elastic.co/t/logstash-fingerprint-plugin-how-to-exclude-timestamp/112498/2 "2017-12-19T19:53:00Z")
What are you setting method to? If UUID, then it is generating a unique UUID every time by design.
Have you looked at using a uuid filter instead?
---
### Author:  [@shreyask](https://discuss.elastic.co/u/shreyask)
#### Post date: [December 19, 2017, 8:02pm UTC](https://discuss.elastic.co/t/logstash-fingerprint-plugin-how-to-exclude-timestamp/112498/3 "2017-12-19T20:02:24Z")
Thanks for the response.
> [@Badger](#):
>
> What are you setting method to?
> here are the settings I am using.
```
key => "xxxxxxxxxxxx"
method => "SHA256"
concatenate_all_fields => true
```
I am using the fingerprint field as `_id` in ES to eliminate duplicates, I did think about using `uuid` filter but it generates just an `uuid` regardless of the content and I wanted to have something in place that is content driven. Fingerprint plugin solves everything if only there is a way to drop `@timestamp`
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 19, 2017, 9:04pm UTC](https://discuss.elastic.co/t/logstash-fingerprint-plugin-how-to-exclude-timestamp/112498/4 "2017-12-19T21:04:44Z")
I don't know what version you are running, in 6.0 it would look like this:
```
fingerprint {
key => "abc123"
concatenate_sources => "true"
method => "SHA256"
source => ["foo", "bar"]
}
```
and then you do get the same fingerprint for two records if those two fields match. I wonder if concatenate\_all\_fields was replaced to resolve exactly this issue.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 19, 2017, 9:28pm UTC](https://discuss.elastic.co/t/logstash-fingerprint-plugin-how-to-exclude-timestamp/112498/5 "2017-12-19T21:28:38Z")
@shreyask OK, so there is an error in the 6.0 documentation so that the concatenate\_all\_fields option is named as a duplicate of concatenate\_source.
Yes, if you use concatenate\_all\_fields it concatenates all fields including the timestamp. A search in the discussions suggests the way to fix this is to use a ruby filter to do the field concatenation (excluding timestamp) and add that as a field, then fingerprint with that added field as the source.
---
### Author:  [@shreyask](https://discuss.elastic.co/u/shreyask)
#### Post date: [December 19, 2017, 9:31pm UTC](https://discuss.elastic.co/t/logstash-fingerprint-plugin-how-to-exclude-timestamp/112498/6 "2017-12-19T21:31:17Z")
I had submitted a PR to [fix the documentation issue](https://github.com/logstash-plugins/logstash-filter-fingerprint/pull/35) but it seems like the documentation was not updated on the website. I will take the filter route as it seems a good way to workaround this issue.
Thanks @Badger for the help. Can you point to the specific post regarding the ruby filter?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 19, 2017, 9:40pm UTC](https://discuss.elastic.co/t/logstash-fingerprint-plugin-how-to-exclude-timestamp/112498/7 "2017-12-19T21:40:22Z")
The suggestion to use a filter was [here](https://discuss.elastic.co/t/logstash-fingerprint-hash-everything/77827/2). [This](https://discuss.elastic.co/t/how-to-concatenate-fields-inside-an-array-using-logstash/100148/2) post solves a different problem, but shows you how to get the event data and to add a field. Now you just need add code to iterate over the fields.
---
### Author:  [@shreyask](https://discuss.elastic.co/u/shreyask)
#### Post date: [December 19, 2017, 9:41pm UTC](https://discuss.elastic.co/t/logstash-fingerprint-plugin-how-to-exclude-timestamp/112498/8 "2017-12-19T21:41:58Z")
Thanks a lot! @Badger
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 20, 2017, 1:33pm UTC](https://discuss.elastic.co/t/logstash-fingerprint-plugin-how-to-exclude-timestamp/112498/9 "2017-12-20T13:33:38Z")
@shreyask I wanted to know the answer, so I experimented till I got this working. My apologies if my ruby coding style makes your eyeballs bleed. Not sure if you will also want to filter out host and @version.
```
filter {
ruby {
code => "
s = ''
h = event.to_hash
h.each { |k, v|
if k != '@timestamp'
s += ',' + k.to_s + ':' + v.to_s
end
}
event.set('some-field-name', s)
"
}
fingerprint {
key => "abc123"
source => "some-field-name"
method => "SHA256"
}
}
```
```
{
"bar" => 1234,
"@timestamp" => 2017-12-20T13:29:37.110Z,
"foo" => "0f4c2678",
"@version" => "1",
"host" => "[...]",
"fingerprint" => "732e31008aa3d3fdfda1d1160994c561ef5022e6e5183598c90b4e69f76c2db9",
"some-field-name" => ",@version:1,host:[...],bar:1234,foo:0f4c2678"
}
{
"bar" => 1234,
"@timestamp" => 2017-12-20T13:29:37.150Z,
"foo" => "0f4c2678",
"@version" => "1",
"host" => "[...]",
"fingerprint" => "732e31008aa3d3fdfda1d1160994c561ef5022e6e5183598c90b4e69f76c2db9",
"some-field-name" => ",@version:1,host:[...],bar:1234,foo:0f4c2678"
}
```
```
```
---
### Author:  [@shreyask](https://discuss.elastic.co/u/shreyask)
#### Post date: [December 29, 2017, 8:45am UTC](https://discuss.elastic.co/t/logstash-fingerprint-plugin-how-to-exclude-timestamp/112498/10 "2017-12-29T08:45:11Z")
Thanks a lot @Badger this works perfectly!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 26, 2018, 8:45am UTC](https://discuss.elastic.co/t/logstash-fingerprint-plugin-how-to-exclude-timestamp/112498/11 "2018-01-26T08:45:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.