Processing hashlist/Json attributes with fingerprint plugin

Elastic Stack Logstash
1

Hi all,

I try to get the values of a kv-plugin produces Key-Value Hashlist parameter to process it by the fingerprint-plugin. So here are my filter code and the result.

filter {
  kv {
    source => "uriparam"
    field_split => "=&"
    target => "uriparams"
  }
  json_encode {
    source => "uriparams"
  }
  json {
    source => "uriparams"
    target => "test"
  }
}

Result in:

"test" => {
    "key1" => "var1",
    "key2" => "var2"
},
"uriparams" => "{\"key1\":\"var1\",\"key2\":\"var2\"}"

How can I get all Values from the Hashlist or the Json-String to process all of them by the fingerprint-plugin to produces Hashed Values instead of human readable ones?

I could'nt find a solution for that usecase.

2

You mean you want {"key1": "<hash of var1>", ...} instead of {"key1": "var1", ...}? You'll have to use a ruby filter for that.

3

Thanks for answering. So I found a solution for that with logstash's ruby filter plugin.

ruby {
  add_field => { "uriparams_hashed" => {} }
  code => "
    if event.get('[uriparams]')
      event.get('[uriparams]').each { |key, value| event.set('[uriparams_hashed]['+key.to_s+']', Digest::MD5.digest(value)) }
    end "
}
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.