# Logstash fingerprint with concatenate\_all\_fields validation

**URL:** <https://discuss.elastic.co/t/logstash-fingerprint-with-concatenate-all-fields-validation/195193>\
**Category:** Logstash\
**Created:** [August 14, 2019, 11:40am UTC](https://discuss.elastic.co/t/logstash-fingerprint-with-concatenate-all-fields-validation/195193 "2019-08-14T11:40:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![PA3mEP](https://avatars.discourse-cdn.com/v4/letter/p/53a042/32.png) [@PA3mEP](https://discuss.elastic.co/u/PA3mEP)\
**Post date:** [August 14, 2019, 11:40am UTC](https://discuss.elastic.co/t/logstash-fingerprint-with-concatenate-all-fields-validation/195193/1 "2019-08-14T11:40:25Z")

</div>

Hi, I need some help with the fingerprint validation that was produced using fingerprint logstash filter. at the moment pipeline config looks like this:

input  
{  
jdbc  
{  
jdbc\_driver\_library =\> "/usr/share/logstash/logstash-core/lib/jars/postgresql-42.2.5.jar"  
jdbc\_driver\_class =\> "org.postgresql.Driver"  
jdbc\_connection\_string =\> "jdbc:postgresql://pg.server:5432/sz"  
jdbc\_user =\> "archiver"  
jdbc\_password =\> "some\_password"  
statement =\> "select  
id as id,  
log\_record as log\_record,  
creation\_time as creation\_time,  
to\_char(creation\_time, 'YYYY.MM.DD') as log\_date  
from some\_table  
where id \> :sql\_last\_value"  
use\_column\_value =\> true  
tracking\_column =\> "id"  
tracking\_column\_type =\> "numeric"  
jdbc\_paging\_enabled =\> true  
jdbc\_page\_size =\> "1000000"  
schedule =\> "\*/15 \* \* \* \*"  
last\_run\_metadata\_path =\> "/srv/logstash-data/.some\_table\_jdbc\_last\_run"  
}  
}

filter {  
fingerprint {  
concatenate\_all\_fields =\> true  
method =\> "SHA256"  
}  
}  
output {  
elasticsearch {  
hosts =\> ["[https://elk1.test:9200](https://elk1.test:9200)", "[https://elk2:9200](https://elk2:9200)"]  
index =\> "some\_table-%{[log\_date]}"  
ssl =\> true  
user =\> user  
password =\> password  
ssl\_certificate\_verification =\> true  
keystore =\> "/etc/logstash/some\_cert.p12"  
keystore\_password =\> "cert\_pass"  
truststore =\> "/etc/logstash/some\_cert.p12"  
truststore\_password =\> "some\_pass"  
}  
}

this setup produces a fingerprint field with hash in it, and document looks like this in JSON format

{  
"\_index": "some\_table-2019.08.13",  
"\_type": "\_doc",  
"\_id": "MeiejGwBtwnGL-3jnLNj",  
"\_version": 1,  
"\_score": null,  
"\_source": {  
"fingerprint": "30aa8ca17fa746535dcc7b96dc73a2ebb9d3e8de92eb129abf56d1548ebc30dd",  
"creation\_time": "2019-08-13T20:14:25.978Z",  
"log\_record": "{"category":"ADMINISTRATION","role":"ADMIN","params":{"message":"User authentication successful"},"auditTimeStamp":"2019-08-13T20:14:25.966Z"} ECDSA:MGUCME9+Xj4KXop5BuemX5oEPDWYETMR7M1SPSqzRwGyNgxOxV0lmSJIco9xQawSP4K0awIxAK0Pal5KPg+phlN/qPnTjymFFS1ESQNC6MJTAgs9ZZizdudQlF/RYZ8IuhECN1dwAg==",  
"log\_date": "2019.08.13",  
"id": 14335915,  
"@timestamp": "2019-08-13T20:15:00.514Z",  
"@version": "1"  
},  
"fields": {  
"creation\_time": [  
"2019-08-13T20:14:25.978Z"  
],  
"@timestamp": [  
"2019-08-13T20:15:00.514Z"  
]  
},  
"sort": [  
1565727300514  
]  
}

How I have to some how validate that data in document and fingerprint are matching.

So my question is, what is the exact format of data that logstash produces hash from, when concatenate\_all\_fields is set to true. What fields are concatenated, in what order and format.

Thanks a lot in advance.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 14, 2019, 12:40pm UTC](https://discuss.elastic.co/t/logstash-fingerprint-with-concatenate-all-fields-validation/195193/2 "2019-08-14T12:40:49Z")

</div>

> [@PA3mEP](#):
>
> what is the exact format of data that logstash produces hash from, when concatenate\_all\_fields is set to true

The code is [here](https://github.com/logstash-plugins/logstash-filter-fingerprint/blob/3ed62ae8e1e379a2d7ab4285c1a5fd43c37bbd5f/lib/logstash/filters/fingerprint.rb#L121).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 11, 2019, 12:40pm UTC](https://discuss.elastic.co/t/logstash-fingerprint-with-concatenate-all-fields-validation/195193/3 "2019-09-11T12:40:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.