Computes a cryptographic MD5-hashing of an input string of one field or an
array of fields. The hashed output is returned as a
hex
string, meaning the hexadecimal
representation of the MD5 hash of data.
This function can be used to calculate checksums to compare outside of LogScale or collect multiple fields into a combined string of fixed length.
Hide omitted argument names for this function
Omitted Argument NamesThe argument name for
field
can be omitted; the following forms of this function are equivalent:logscalecrypto:md5("field")
and:
logscalecrypto:md5(field="field")
These examples show basic structure only.
crypto:md5()
hashes the UTF-8 encoding of the fields.
When providing more than one field:
the function hashes the concatenation of the fields
if a given field is missing from an event — or if it has an empty value — it is treated as the empty string.
crypto:md5()
Examples
Hash a field with a given value
Query
a := "Hello, world!"
| crypto:md5(a)
Introduction
Hash the field a with
value Hello, world!
and
convert the result into
_md5
:
Step-by-Step
Starting with the source repository events
- logscale
a := "Hello, world!"
Find all fields equal to
Hello, world!
- logscale
| crypto:md5(a)
Performs a cryptographic MD5-hashing of a:= "Hello, world!".
Event Result set
Summary and Results
The output value would be _md5 =
"6cd3556deb0da54bca060b4c39479839"
Hash multiple fields
Query
crypto:md5(field=[a,b,c])
Introduction
Hash the fields a,b,c and
put the result into _md5
:
Step-by-Step
Starting with the source repository events
- logscale
crypto:md5(field=[a,b,c])
Performs a cryptographic MD5-hashing of a,b,c. The
field
argument can be omitted to write:crypto:md5([a,b,c])
Event Result set
Summary and Results
When called with multiple values,
crypto:md5()
creates a single MD5 sum from
the combined value of the supplied fields. Combining fields in
this way and converting to an MD5 can be an effective method of
creating a unique ID for a given fieldset which could be used to
identify a specific event type. The MD5 is reproducible (i.e.
supplying the same values will produce the same MD5 sum), and so
it can somtimes be an effective method of creating unique
identifier or lookup fields for a join()
across two different datasets.