Unclear how logstash fingerprint treats empty/non-existing fields

I found my error:
I misunderstood the

concatenate_all_fields => true

flag. Of course this parameter take into account not only the fields given in "source" but also the other fields including the hash which was calculated in the first run.

What I haven't figured out yet is how to compute the hash with a different method like e.g. with python. Especially nested fields give me a hard time.

But this is a different question and this one here can be marked as solved.