This functionality is experimental and may be changed or removed completely in a future release. Elastic will take a best effort approach to fix any issues, but experimental features are not subject to the support SLA of official GA features.

« Extract array Keep fields from events »

› › ›

Generate a fingerprint of an event

edit

Generate a fingerprint of an event

edit

The fingerprint processor generates a fingerprint of an event based on a specified subset of its fields.

processors:
 - fingerprint:
     fields: ["field1", "field2", ...]

The following settings are supported:

fields: List of fields to use as the source for the fingerprint.
ignore_missing: (Optional) Whether to ignore missing fields. Default is false.
target_field: (Optional) Field in which the generated fingerprint should be stored. Default is fingerprint.
method: (Optional) Algorithm to use for computing the fingerprint. Must be one of: md5, sha1, sha256, sha384, sha512, xxhash. Default is sha256.
encoding: (Optional) Encoding to use on the fingerprint value. Must be one of hex, base32, or base64. Default is hex.

« Extract array Keep fields from events »