Computes a cryptographic MD5-hashing of an input string of one field or an array of fields. The hashed output is returned as a hex string, meaning the hexadecimal representation of the MD5 hash of data.

This function can be used to calculate checksums to compare outside of LogScale or collect multiple fields into a combined string of fixed length.

ParameterTypeRequiredDefault ValueDescription
asstringoptional[a]_md5 The name of the output field.
field[b]Array of stringsrequired  The name of the field or fields to hash.

[a] Optional parameters use their default value unless explicitly set.

[b] The argument name field can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

crypto:md5() hashes the UTF-8 encoding of the fields.

When providing more than one field:

  • the function hashes the concatenation of the fields

  • if a given field is missing from an event — or if it has an empty value — it is treated as the empty string.

crypto:md5() Examples

MD5 Hash Multiple Fields

Query
logscale
crypto:md5(field=[a,b,c])
Introduction

In LogScale it is possible to encode strings using different algorithms such as MD5, SHA-1, and SHA-256 and create a hash; also called a fingerprint. The MD5 hash function is the weakest of the three, whereas SHA-256 is the strongest. The crypto:md5() function is used to create the MD5 hash by taking a string of any length and encoding it into a 128-bit fingerprint. The fingerprint is returned as hexadecimal characters. Encoding the same string using the MD5 algorithm will always result in the same 128-bit hash output (16 hexadecimal digits). In this example, the crypto:md5() function is used to hash the fields a,b,c and return the result into a field named _md5.

Step-by-Step

  1. Starting with the source repository events

  2. logscale
    crypto:md5(field=[a,b,c])

    Performs a cryptographic MD5-hashing of a,b,c. The field argument can be omitted to write: crypto:md5([a,b,c])

  3. Event Result set

Summary and Results

The query is used to encode a string using the MD5 hash. When called with multiple values, crypto:md5() function creates a single MD5 sum from the combined value of the supplied fields. Combining fields in this way and converting to an MD5 can be an effective method of creating a unique ID for a given fieldset which could be used to identify a specific event type. The MD5 is reproducible (for example, supplying the same values will produce the same MD5 sum), and so it can sometimes be an effective method of creating unique identifier or lookup fields for a join() across two different datasets.

MD5 Hash a Field with a Given Value

Query
logscale
a := "Hello, world!"
| crypto:md5(a)
Introduction

In LogScale it is possible to encode strings using different algorithms such as MD5, SHA-1, and SHA-256 and create a hash; also called a fingerprint. The MD5 hash function is the weakest of the three, whereas SHA-256 is the strongest. The crypto:sha256() function is used to create the SHA-256 hash by taking a string of any length and encoding it into a 256-bit fingerprint. The fingerprint is returned as hexadecimal characters. Encoding the same string using the SHA-256 algorithm will always result in the same 256-bit hash output (64 hexadecimal digits). In this example, the crypto:md5() function is used to hash the field a with value Hello, world! and convert the result into _md5:

Step-by-Step

  1. Starting with the source repository events

  2. logscale
    a := "Hello, world!"

    Finds all fields equal to Hello, world!

  3. logscale
    | crypto:md5(a)

    Performs a cryptographic MD5-hashing of a:= "Hello, world!". The output value would be _md5 = "6cd3556deb0da54bca060b4c39479839"

  4. Event Result set

Summary and Results

The query is used to encode a string using the MD5 hash. The hash generators MD5, SHA-1, and SHA-256 are for example useful for encoding passwords or representing other strings in the system as hashed values.