Calculates a secure hash of a field for storing in the event. See hashMatch() on how to search for events using hashes. Bits can reduce the width of the output if desired to keep the resulting strings short.

ParameterTypeRequiredDefault ValueDescription
asstringoptional[a]   The name of output field, defaults to the input field.
bitsintegeroptional[a] 256 Hash algorithm output bits to keep. Must be a multiple of 8.
  Minimum8 
  Maximum512 
field[b]stringrequired   The name of the field to hash.
hashstringoptional[a] sha256 Hash algorithm.
   Values
   sha256
   sha512
replaceInRawstringbooleanoptional[a] true Replace all substrings in @rawstring that has the input value with the hash too.
saltstringrequired   The name of the secret salt to use.

[a] Optional parameters use their default value unless explicitly set.

[b] The parameter name field can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

hashRewrite() Syntax Examples

Replace the value in the ssn field with the hash of the existing value, also replacing it in @rawstring

logscale
hashRewrite(ssn, salt="salt1")

hashRewrite() Examples

Click + next to an example below to get the full details.

Hash Field Values Using hashRewrite()

Hash sensitive data using the hashRewrite() function with a salt value

Query
logscale
hashRewrite(ssn, salt="salt1")
Introduction

In this example, the hashRewrite() function is used to hash Social Security Numbers (SSNs) using a specified salt value (salt equal to salt1).

Example incoming data might look like this:

@timestampuser_idssnaction
2025-09-01T10:00:00Zuser1123-45-6789profile_update
2025-09-01T10:00:05Zuser2123-45-6789new_account
2025-09-01T10:00:10Zuser3456-78-9012profile_view
Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    hashRewrite(ssn, salt="salt1")

    Hashes the values in the ssn field through a multi-step process. First the hashRewrite() function takes each value in the ssn field and adds the salt value salt1 to it before hashing. The function then creates a hash of the combined value (original + salt) and replaces the original value with the resulting hash.

    Note that the salt value requires specific handling for security purposes. It must be kept consistent when searching for these values later, stored securely outside the log data, and should be different for different types of sensitive data.

  3. Event Result set.

Summary and Results

The query is used to securely hash sensitive SSN values while maintaining the ability to search for specific SSNs later using the same salt.

The salt makes the hashing process more secure by:

  • Making the hash unique even if SSNs are identical.

  • Preventing the use of pre-computed hash tables (rainbow tables) to reverse the hash.

  • Adding an extra layer of security beyond the basic hash.

This query is useful, for example, when you need to protect sensitive data while still being able to analyze it.

Sample output from the incoming example data:

@timestampactionssnuser_id
2025-09-01T10:00:00Zprofile_updateC4ZkaokbIUltItryWgtdRmIdCCnsWVhhrOg3GDrTkx8user1
2025-09-01T10:00:05Znew_accountC4ZkaokbIUltItryWgtdRmIdCCnsWVhhrOg3GDrTkx8user2
2025-09-01T10:00:10Zprofile_viewnaHQMPbzY6pLiFG8aiJzfxw5Gj4mLQ+bf2b0AJv8OPQuser3

Notice that identical SSNs (first two rows) produce identical hashes because they use the same salt. If you used a different salt, then the same SSNs would produce different hashes.

The example demonstrates how to use hashRewrite() in LogScale to protect sensitive data while maintaining searchability. To search for specific SSNs in the hashed data, use hashMatch() with the same salt value.

After hashing sensitive data using this method, you can search for specific values using either Match Hashed Values in Specific Fields for field-specific searches or Match Events Containing Specific Hash Values for searching anywhere in the event data.