Computes a non-cryptographic hash of a list of fields. The hash is returned as an integer in the range [0,4294967295]. Calling this function with the same values and the same seed (or no seed) will result in the same hash being computed. This hash is not cryptographic and should not be used to securely obscure data (instead use hashRewrite() and hashMatch() for that). This function can, for example, be used to reduce the number of groups in a groupBy(), at the cost of having collisions.

ParameterTypeRequiredDefault ValueDescription
asstringoptional[a] _hash The output name of the field to set.
field[b]array of stringsrequired   The fields for which to compute hash values.
limitnumberoptional[a]   An upper bound on the number returned by this function. The returned hash will be modulo this value and thus be constrained to the range [0,limit].
  Minimum1 
seedstringoptional[a]   An optional seed for the hash function.

[a] Optional parameters use their default value unless explicitly set.

[b] The parameter name field can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

hash()Syntax Examples

Hash the field a and put the result into _hash:

logscale
hash(a)

Hash the fields a, b, and c and put the result modulo 10 into _hash

logscale
hash([a,b,c], limit=10)

Hash the field a (by setting field explicitly) using a seed of 10

logscale
hash(field=[a], seed=10)

Group events into 10 buckets such that all events with the same value of a ends in the same bucket.

logscale
hash(a, limit=10)
| groupBy(_hash)

hash() Examples

Click + next to an example below to get the full details.

MD5 Hash Multiple Fields

MD5 hash multiple fields using the crypto:md5() function

Query
logscale
crypto:md5(field=[a,b,c])
Introduction

In this example, the crypto:md5() function is used to hash the fields a,b,c and return the result into a field named _md5.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    crypto:md5(field=[a,b,c])

    Performs a cryptographic MD5-hashing of a,b,c. The field argument can be omitted to write: crypto:md5([a,b,c])

  3. Event Result set.

Summary and Results

The query is used to encode a string using the MD5 hash. When called with multiple values, crypto:md5() function creates a single MD5 sum from the combined value of the supplied fields. Combining fields in this way and converting to an MD5 can be an effective method of creating a unique ID for a given fieldset which could be used to identify a specific event type. The MD5 is reproducible (for example, supplying the same values will produce the same MD5 sum), and so it can sometimes be an effective method of creating unique identifier or lookup fields for a join() across two different datasets.

MD5 Hash a Field With a Given Value

MD5 hash a field with a given value using the crypto:md5() function

Query
logscale
a := "Hello, world!"
| crypto:md5(a)
Introduction

In this example, the crypto:md5() function is used to hash the field a with value Hello, world! and convert the result into _md5.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    a := "Hello, world!"

    Assigns the value Hello, world! to the field a.

  3. logscale
    | crypto:md5(a)

    Performs a cryptographic MD5-hashing of a:= "Hello, world!". The output value would be _md5 = "6cd3556deb0da54bca060b4c39479839"

  4. Event Result set.

Summary and Results

The query is used to encode a string using the MD5 hash. The hash generators MD5, SHA-1, and SHA-256 are, for example, useful for encoding passwords or representing other strings in the system as hashed values.

SHA-1 Hash Multiple Fields

SHA-1 hash multiple fields using the crypto:sha1() function

Query
logscale
crypto:sha1(field=[a,b,c])
Introduction

In this example, the crypto:sha1() function is used to hash the fields a,b,c and return the result into a field named _sha1.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    crypto:sha1(field=[a,b,c])

    Performs a cryptographic SHA1-hashing of a,b,c. The field argument can be omitted to write: crypto:sha1([a,b,c])

  3. Event Result set.

Summary and Results

The query is used to encode a string using the SHA-1 hash. When called with multiple values, crypto:sha1() function creates a single SHA-1 sum from the combined value of the supplied fields. Combining fields in this way and converting to an SHa-1 can be an effective method of creating a unique ID for a given fieldset which could be used to identify a specific event type. The SHA-1 is reproducible (for example, supplying the same values will produce the same SHA-1 sum), and so it can sometimes be an effective method of creating unique identifier or lookup fields for a join() across two different datasets.

SHA-1 Hash a Field With a Given Value

SHA-1 hash a field with a given value using the crypto:sha1() function

Query
logscale
a := "Hello, world!"
| crypto:sha1(a)
Introduction

In this example, the crypto:sha1() function is used to hash the field a with value Hello, world! and convert the result into _sha1.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    a := "Hello, world!"

    Assigns the value Hello, world! to the field a.

  3. logscale
    | crypto:sha1(a)

    Performs a cryptographic SHA-1-hashing of a:= "Hello, world!". The output value would be _sha1 = "943a702d06f34599aee1f8da8ef9f7296031d699"

  4. Event Result set.

Summary and Results

The query is used to encode a string using the SHA-1 hash. The hash generators MD5, SHA-1, and SHA-256 are, for example, useful for encoding passwords or representing other strings in the system as hashed values.

SHA-256 Hash Multiple Fields

SHA-256 hash multiple fields using the crypto:sha256() function

Query
logscale
crypto:sha256(field=[a,b,c])
Introduction

In this example, the crypto:sha256() function is used to hash the fields a,b,c and return the result into a field named _sha256.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    crypto:sha256(field=[a,b,c])

    Performs a cryptographic SHA256-hashing of a,b,c. The field argument can be omitted to write: crypto:sha1([a,b,c])

  3. Event Result set.

Summary and Results

The query is used to encode a string using the SHA-256 hash. When called with multiple values, crypto:sha256() function creates a single SHA-256 sum from the combined value of the supplied fields. Combining fields in this way and converting to an SHa-256 can be an effective method of creating a unique ID for a given fieldset which could be used to identify a specific event type. The SHA-256 is reproducible (for example, supplying the same values will produce the same SHA-256 sum), and so it can sometimes be an effective method of creating unique identifier or lookup fields for a join() across two different datasets.

SHA-256 Hash a Field With a Given Value

SHA-256 hash a field with a given value using the crypto:sha256() function

Query
logscale
a := "Hello, world!"
| crypto:sha256(a)
Introduction

In this example, the crypto:sha256() function is used to hash the field a with value Hello, world! and convert the result into _sha256.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    a := "Hello, world!"

    Assigns the value Hello, world! to the field a.

  3. logscale
    | crypto:sha256(a)

    Performs a cryptographic SHA-256-hashing of a:= "Hello, world!". The output value would be _sha256 = "315f5bdb76d078c43b8ac0064e4a0164612b1fce77c869345bfc94c75894edd3"

  4. Event Result set.

Summary and Results

The query is used to encode a string using the SHA-256 hash. The hash generators MD5, SHA-1, and SHA-256 are, for example, useful for encoding passwords or representing other strings in the system as hashed values.