Calculates a secure hash of a field and uses that to match events as a
filter. See hashRewrite()
on how get hashes into
events. Bits must be set to the value applied when the hash was stored in
the event.
Parameter | Type | Required | Default | Description | |
---|---|---|---|---|---|
bits | integer | optional[a] | 256 | Hash algorithm output bits to keep. Must be a multiple of 8. | |
Minimum | 8 | ||||
Maximum | 512 | ||||
field | string | optional[a] | The name of the field to look for an exact match against. If not set then @rawstring is searched for a matching substring. | ||
hash | string | optional[a] | sha256 | Hash algorithm to use for the match | |
Valid Values | |||||
sha256 | |||||
sha512 | |||||
input [b] | string | required | A constant value to hash and then apply as the search term. | ||
salt | string | optional[a] | The name of the secret salt to use. | ||
[a] Optional parameters use their default value unless explicitly set. |
Hide omitted argument names for this function
Omitted Argument NamesThe argument name for
input
can be omitted; the following forms of this function are equivalent:logscalehashMatch("value")
and:
logscalehashMatch(input="value")
These examples show basic structure only.
hashMatch()
Examples
Filter events to only match those that have the value in the
ssn
field equal to the hash of 12345678
logscale
ssn =~ hashMatch("12345678", salt="salt1")
Filter events to only match those that have the value of the hash of 12345678 somewhere in @rawstring
logscale
hashMatch("12345678", salt="salt1")