Use uuid or fingerprint for document_id?

Elastic Stack Logstash
1

Hello. I'm currently using a combination of a fingerprint field:

fingerprint {
key => “thisismykey“
method => "MD5"
}

And a timestamp to generate a unique id so that i can prevent duplicates if the same log file is ingested multiple times.

To put them together I'm using this:

code => "event['[company][computed_id]'] = event['@timestamp'].to_i.to_s + '_' + event['fingerprint']"

My concatenation may be redundant since I'm already taking a fingerprint of the message which includes a timestamp but I wanted to be certain.

I ran across the UUID plugin earlier today and that made me wonder if it would make a better unique identifier since my fingerprint is simply hashing the entire message. I've looked but cannot find anything showing how the UUID is calculated for LS entries so I'm not completely sure how much of a log entry can change before the UUID changes. I'd assume nothing could change but wanted to make sure.

Can anyone tell me if using UUID is the most efficient use for preventing duplications?

Thanks for any recommendations,
Donald

2

The whole point of a UUID is to be unique every single time it's generated, so it's a bad choice for creating a reproducible id. I see that the documentation recommends its use for this purpose which is blatantly false. I don't have time to fix this right now but I've filed https://github.com/logstash-plugins/logstash-filter-uuid/issues/6 for it.

3

Thank you for the quick and helpful response.