README
¶
Hash plugin
It calculates the hash for one of the specified event fields and adds a new field with result in the event root.
Fields can be of any type except for an object and an array.
Examples
Hashing without normalization (first found field is error.code):
pipelines:
example_pipeline:
...
actions:
- type: hash
fields:
- field: error.code
- field: level
result_field: hash
...
The original event:
{
"level": "error",
"error": {
"code": "unauthenticated",
"message": "bad token format"
}
}
The resulting event:
{
"level": "error",
"error": {
"code": "unauthenticated",
"message": "bad token format"
},
"hash": 6584967863753642363,
}
Hashing with normalization (first found field is message):
pipelines:
example_pipeline:
...
actions:
- type: hash
fields:
- field: error.code
- field: message
format: normalize
result_field: hash
...
The original event:
{
"level": "error",
"message": "2023-10-30T13:35:33.638720813Z error occurred, client: 10.125.172.251, upstream: \"http://10.117.246.15:84/download\", host: \"mpm-youtube-downloader-38.name.com:84\""
}
Normalized 'message':
<datetime> error occurred, client: <ip>, upstream: "<url>", host: "<host>:<int>"
The resulting event:
{
"level": "error",
"message": "2023-10-30T13:35:33.638720813Z error occurred, client: 10.125.172.251, upstream: \"http://10.117.246.15:84/download\", host: \"mpm-youtube-downloader-38.name.com:84\"",
"hash": 13863947727397728753,
}
Config params
fields []Field required
Prioritized list of fields. The first field found will be used to calculate the hash.
Field params:
-
fieldcfg.FieldSelectorrequiredThe event field for calculating the hash.
-
formatstringdefault=nooptions=no|normalizeThe field format for various hashing algorithms.
-
max_sizeintdefault=0The maximum field size used in hash calculation of any format. If set to
0, the entire field will be used in hash calculation.If the field size is greater than
max_size, then the firstmax_sizebytes will be used in hash calculation.It can be useful in case of performance degradation when calculating the hash of long fields.
result_field cfg.FieldSelector required
The event field to which put the hash.
Generated using insane-doc
Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// > @3@4@5@6
// >
// > Prioritized list of fields. The first field found will be used to calculate the hash.
// >
// > `Field` params:
// > * **`field`** *`cfg.FieldSelector`* *`required`*
// >
// > The event field for calculating the hash.
// >
// > * **`format`** *`string`* *`default=no`* *`options=no|normalize`*
// >
// > The field format for various hashing algorithms.
// >
// > * **`max_size`** *`int`* *`default=0`*
// >
// > The maximum field size used in hash calculation of any format.
// > If set to `0`, the entire field will be used in hash calculation.
// >
// > > If the field size is greater than `max_size`, then
// > the first `max_size` bytes will be used in hash calculation.
// > >
// > > It can be useful in case of performance degradation when calculating the hash of long fields.
Fields []Field `json:"fields" slice:"true" required:"true"` // *
// > @3@4@5@6
// >
// > The event field to which put the hash.
ResultField cfg.FieldSelector `json:"result_field" parse:"selector" required:"true"` // *
ResultField_ []string
}
! config-params ^ config-params
type Field ¶
type Field struct {
Field cfg.FieldSelector `json:"field" parse:"selector" required:"true"`
Field_ []string
Format string `json:"format" default:"no" options:"no|normalize"`
Format_ fieldFormat
MaxSize int `json:"max_size" default:"0"`
}
Source Files
Directories