Computes a cryptographic MD5-hashing of an input string of one field or an
array of fields. The hashed output is returned as a
hex
string, meaning the hexadecimal
representation of the MD5 hash of data.
This function can be used to calculate checksums to compare outside of LogScale or collect multiple fields into a combined string of fixed length.
Hide omitted argument names for this function
Omitted Argument NamesThe argument name for
field
can be omitted; the following forms of this function are equivalent:logscalecrypto:md5("field")
and:
logscalecrypto:md5(field="field")
These examples show basic structure only.
crypto:md5()
hashes the UTF-8 encoding of the fields.
When providing more than one field:
the function hashes the concatenation of the fields
if a given field is missing from an event — or if it has an empty value — it is treated as the empty string.
crypto:md5()
Examples
MD5 Hash Multiple Fields
Query
crypto:md5(field=[a,b,c])
Introduction
In LogScale it is possible to encode strings using
different algorithms such as MD5
,
SHA-1
, and SHA-256
and
create a hash; also called a fingerprint. The MD5 hash function is
the weakest of the three, whereas SHA-256 is the strongest. The
crypto:md5()
function is used to create the
MD5 hash by taking a string of any length and encoding it into a
128-bit fingerprint. The fingerprint is returned as hexadecimal
characters. Encoding the same string using the MD5 algorithm will
always result in the same 128-bit hash output (16 hexadecimal
digits). In this example, the crypto:md5()
function is used to hash the fields
a,b,c and return the
result into a field named
_md5
.
Step-by-Step
Starting with the source repository events.
- logscale
crypto:md5(field=[a,b,c])
Performs a cryptographic MD5-hashing of a,b,c. The
field
argument can be omitted to write:crypto:md5([a,b,c])
Event Result set.
Summary and Results
The query is used to encode a string using the MD5 hash. When
called with multiple values, crypto:md5()
function creates a single MD5 sum from the combined value of the
supplied fields. Combining fields in this way and converting to an
MD5 can be an effective method of creating a unique ID for a given
fieldset which could be used to identify a specific event type.
The MD5 is reproducible (for example, supplying the same values
will produce the same MD5 sum), and so it can sometimes be an
effective method of creating unique identifier or lookup fields
for a join()
across two different datasets.
MD5 Hash a Field with a Given Value
Query
a := "Hello, world!"
| crypto:md5(a)
Introduction
In LogScale it is possible to encode strings using
different algorithms such as MD5
,
SHA-1
, and SHA-256
and
create a hash; also called a fingerprint. The MD5 hash function is
the weakest of the three, whereas SHA-256 is the strongest. The
crypto:sha256()
function is used to create
the SHA-256 hash by taking a string of any length and encoding it
into a 256-bit fingerprint. The fingerprint is returned as
hexadecimal characters. Encoding the same string using the SHA-256
algorithm will always result in the same 256-bit hash output (64
hexadecimal digits). In this example, the
crypto:md5()
function is used to hash the
field a with value
Hello, world!
and convert
the result into _md5
:
Step-by-Step
Starting with the source repository events.
- logscale
a := "Hello, world!"
Finds all fields equal to
Hello, world!
- logscale
| crypto:md5(a)
Performs a cryptographic MD5-hashing of a:= "Hello, world!". The output value would be
_md5 = "6cd3556deb0da54bca060b4c39479839"
Event Result set.
Summary and Results
The query is used to encode a string using the MD5 hash. The
hash generators MD5
,
SHA-1
, and SHA-256
are for
example useful for encoding passwords or representing other
strings in the system as hashed values.