Calculates a secure hash of a field and uses that to match events as a filter. See hashRewrite() on how get hashes into events. Bits must be set to the value applied when the hash was stored in the event.

ParameterTypeRequiredDefault ValueDescription
bitsintegeroptional[a] 256 Hash algorithm output bits to keep. Must be a multiple of 8.
  Minimum8 
  Maximum256 
fieldstringoptional[a]   The name of the field to look for an exact match against. If not set then @rawstring is searched for a matching substring.
hashstringoptional[a] sha256 Hash algorithm to use for the match.
   Values
   sha256
   sha512
input[b]stringrequired   A constant value to hash and then apply as the search term.
saltstringrequired   The name of the secret salt to use.

[a] Optional parameters use their default value unless explicitly set.

[b] The parameter name input can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

hashMatch() Syntax Examples

Filter events to only match those that have the value in the ssn field equal to the hash of 12345678

logscale
ssn =~ hashMatch("12345678", salt="salt1")

Filter events to only match those that have the value of the hash of 12345678 somewhere in @rawstring

logscale
hashMatch("12345678", salt="salt1")

hashMatch() Examples

Click + next to an example below to get the full details.

Match Events Containing Specific Hash Values

Match events containing a specific hashed value using the hashMatch() function

Query
logscale
hashMatch("456-78-9012", salt="salt1")
Introduction

In this example, the hashMatch() function is used to find events where the value 456-78-9012 appears in the event data as a hash created with the salt equal to salt1.

Example incoming data might look like this:

@timestamp@rawstring
2025-09-01T10:00:00ZUser logged in with hash:C4ZkaokbIUltItryWgtdRmIdCCnsWVhhrOg3GDrTkx8
2025-09-01T10:00:05ZFailed login attempt hash:C4ZkaokbIUltItryWgtdRmIdCCnsWVhhrOg3GDrTkx8
2025-09-01T10:00:10ZPassword reset requested hash:naHQMPbzY6pLiFG8aiJzfxw5Gj4mLQ+bf2b0AJv8OPQ
Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    hashMatch("456-78-9012", salt="salt1")

    Filters events by checking if the hash of value 456-78-9012 (created using the salt salt1) appears anywhere in the @rawstring field. The function creates the hash using the provided value and salt, then searches for this hash pattern in the event data.

  3. Event Result set.

Summary and Results

The query is used to filter events that contain a specific hashed value in their content.

This query is useful, for example, to search for specific sensitive values in logs where the values have been hashed for security purposes, such as finding events related to a specific user ID or account number that has been hashed in the logs.

Sample output from the incoming example data:

@timestamp@rawstring
2025-09-01T10:00:10ZPassword reset requested hash:naHQMPbzY6pLiFG8aiJzfxw5Gj4mLQ+bf2b0AJv8OPQ

Note that the salt value must match the one used when the original hash was created in the data. The function searches for the hash pattern anywhere in the event data.

This example shows how to search for hashed values anywhere in event data. For searching in specific fields, see Match Hashed Values in Specific Fields. To understand how to create searchable hashed data, see Hash Field Values Using hashRewrite() .

Match Hashed Values in Specific Fields

Match events where a field equals a hashed value using the hashMatch() function

Query
logscale
ssn =~ hashMatch("456-78-9012", salt="salt1")
Introduction

In this example, the hashMatch() function is used to filter events where the ssn field matches the hash of a specific value, using a specified salt value for the hashing. A salt is a random string added to the data before hashing to make the hash more secure.

Note that the example uses the hashMatch() function with the comparison operator =~ to match against a specific field.

Example incoming data might look like this:

@timestampactionssnuser_id
2025-09-01T10:00:00Zprofile_updateC4ZkaokbIUltItryWgtdRmIdCCnsWVhhrOg3GDrTkx8user1
2025-09-01T10:00:05Znew_accountC4ZkaokbIUltItryWgtdRmIdCCnsWVhhrOg3GDrTkx8user2
2025-09-01T10:00:10Zprofile_viewnaHQMPbzY6pLiFG8aiJzfxw5Gj4mLQ+bf2b0AJv8OPQuser3
Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    ssn =~ hashMatch("456-78-9012", salt="salt1")

    Filters events where the ssn field value matches the hash of 456-78-9012. The hashMatch() function creates a hash using the specified string and salt value (salt1), then compares it against the value in the ssn field.

    The salt parameter is required and should match the salt used when the original data was hashed (in this case salt1). For more information, see Hash Field Values Using hashRewrite() .

  3. Event Result set.

Summary and Results

The query is used to find events where a hashed field matches an expected value without exposing the original sensitive data.

This query is useful, for example, to track specific user activities in logs where sensitive information like social security numbers are stored in hashed form for security compliance.

Sample output from the incoming example data:

@timestampactionssnuser_id
2025-09-01T10:00:10Zprofile_viewnaHQMPbzY6pLiFG8aiJzfxw5Gj4mLQ+bf2b0AJv8OPQuser3

Only events where the hashed value in ssn matches the hash of 456-78-9012 are included in the results.

This example demonstrates searching for specific hashed values in a named field. For searching hashed values anywhere in event data, see Match Events Containing Specific Hash Values. To learn how to create hashed values that can be searched this way, see Hash Field Values Using hashRewrite() .