# Recompute event.hash for documents in cold indices

**URL:** <https://discuss.elastic.co/t/recompute-event-hash-for-documents-in-cold-indices/321203>\
**Category:** Elasticsearch\
**Tags:** painless, runtime-fields\
**Created:** [December 14, 2022, 9:55am UTC](https://discuss.elastic.co/t/recompute-event-hash-for-documents-in-cold-indices/321203 "2022-12-14T09:55:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ivo.raisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ivo.raisr/32/108521_2.png) [@ivo.raisr](https://discuss.elastic.co/u/ivo.raisr)\
**Post date:** [December 14, 2022, 9:55am UTC](https://discuss.elastic.co/t/recompute-event-hash-for-documents-in-cold-indices/321203/1 "2022-12-14T09:55:42Z")

</div>

For certain datasets which contain important log events, logstash pipeline computes [event.hash](https://www.elastic.co/guide/en/ecs/master/ecs-event.html#field-event-hash), using [fingerprint](https://www.elastic.co/guide/en/logstash/current/plugins-filters-fingerprint.html) filter with SHA256 method and a [key](https://www.elastic.co/guide/en/logstash/current/plugins-filters-fingerprint.html#plugins-filters-fingerprint-key), [over all](https://www.elastic.co/guide/en/logstash/current/plugins-filters-fingerprint.html#plugins-filters-fingerprint-concatenate_all_fields) the event fields. The events are then ingested into elasticsearch.

Now when the documents make it to the cold shards (based on their age), from time to time I need to ensure the documents have not been tampered with, by recomputing the hash again and comparing it to the stored one.

I was thinking to create a search on the dataset with a runtime field mapped to a `painless` script which re-computes the hash. The search would return only documents where the computed hash differs from the stored hash, hopefully including only important fields such as id, timestamp, message, original event.hash and computed hash.

The search then could be triggered from a Kibana watcher. However I am not clear on how to structure such a search. Please could you spare an advice?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 11, 2023, 9:56am UTC](https://discuss.elastic.co/t/recompute-event-hash-for-documents-in-cold-indices/321203/2 "2023-01-11T09:56:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.