Hello
I take the ELK suite in hand and try to do a few things with it to learn.
Currently I'm trying to make a scripted field that will be able to determine a change between two hashes taken at two different moments,
I would like to use this field to determine if there has been a change in a file for example ans create a graph which resume this behavior.
My scripted field name is Diff.
My first data :
{
"_id": "Tj_63HYBDcO2xQXMU82i",
"@timestamp": "2020-11-16T23:09:50.047+01:00",
"SHA256":"784ABCBD7342B9FABB1968694E384147ED1204AD006BC36749D46D395351820C",
"File": "System.Windows.Forms.Design.Editors.resources.dll",
"Diff": [
"No change"
]
}
Second data taken one day later :
{
"_id": "UD_63HYBDcO2xQXMU82i",
"@timestamp": "2020-12-16T23:19:50.047+01:00",
"SHA256":"784ABCBD7342B9FABB1968694E384147ED1204AD006BC36749D46D395351820C",
"File": "System.Windows.Forms.Design.Editors.resources.dll",
"Diff": [
"No change"
]
}
Do you know if it is possible to make this comparison with scripted field ?
Or am I trying to do something that this tool is not made for? In that case, if you had any ideas
Actually I did a couple of things with the help of the tutorials on the site (Great Tutorial here), but I have to admit that I don't go very far :
if(doc['SHA256'].size()==0){
return "error no hash";
} else {
if(doc['SHA256'].value == "784ABCBD7342B9FABB1968694E384147ED1204AD006BC36749D46D395351820C"){
return "No change"
}
else {
return "Changed"
}
}
Thanks for your time and orientation