Computes a cryptographic MD5-hashing of an input string of one field or an array of fields. The hashed output is returned as a hex string, meaning the hexadecimal representation of the MD5 hash of data.

This function can be used to calculate checksums to compare outside of LogScale or collect multiple fields into a combined string of fixed length.

ParameterTypeRequiredDefaultDescription
asstringoptional[a]_md5 The name of the output field.
field[b]Array of stringsrequired  The name of the field or fields to hash.

[a] Optional parameters use their default value unless explicitly set

[b] The argument name field can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

crypto:md5() hashes the UTF-8 encoding of the fields.

When providing more than one field:

  • the function hashes the concatenation of the fields

  • if a given field is missing from an event — or if it has an empty value — it is treated as the empty string.

crypto:md5() Examples

Hash a field with a given value

Query
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1>Augment Data] result{{Result Set}} repo --> 0 0 --> 1 1 --> result
logscale
a := "Hello, world!"
| crypto:md5(a)
Introduction

Hash the field a with value Hello, world! and convert the result into _md5:

Step-by-Step

  1. Starting with the source repository events

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1>Augment Data] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;

    Find all fields equal to Hello, world!

    logscale
    a := "Hello, world!"
  3. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1>Augment Data] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;

    Performs a cryptographic MD5-hashing of a:= "Hello, world!".

    logscale
    | crypto:md5(a)

  4. Event Result set

Summary and Results

The output value would be _md5 = "6cd3556deb0da54bca060b4c39479839"

Hash multiple fields

Query
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0>Augment Data] result{{Result Set}} repo --> 0 0 --> result
logscale
crypto:md5(field=[a,b,c])
Introduction

Hash the fields a,b,c and put the result into _md5 :

Step-by-Step

  1. Starting with the source repository events

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0>Augment Data] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;

    Performs a cryptographic MD5-hashing of a,b,c. The field argument can be omitted to write: crypto:md5([a,b,c])

    logscale
    crypto:md5(field=[a,b,c])

  3. Event Result set

Summary and Results

When called with multiple values, crypto:md5() creates a single MD5 sum from the combined value of the supplied fields. Combining fields in this way and converting to an MD5 can be an effective method of creating a unique ID for a given fieldset which could be used to identify a specific event type. The MD5 is reproducible (i.e. supplying the same values will produce the same MD5 sum), and so it can somtimes be an effective method of creating unique identifier or lookup fields for a join() across two different datasets.