Calculates a secure hash of a field and uses that to match events as a
filter. See hashRewrite() on how get hashes into
events. Bits must be set to the value applied when the hash was stored in
the event.
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
bits | number | false | 256 | Hash algorithm output bits to keep. Must be a multiple of 8 in the range 8 - 512. |
| Minimum | 8 | |||
| Maximum | 512 | |||
field | string | false | The name of the field to look for an exact match against. If not set then @rawstring is searched for a matching substring. | |
hash | string | false | sha256 | Hash algorithm to use for the match |
| Valid Values | sha256 | |||
sha512 | ||||
input | string | true | A constant value to hash and then apply as the search term. [a] | |
salt | string | false | The name of the secret salt to use. | |
hashMatch() Examples
Filter events to only match those that have the value in the
ssn field equal to the hash of 12345678
logscale
ssn =~ hashMatch("12345678", salt="salt1")Filter events to only match those that have the value of the hash of 12345678 somewhere in @rawstring
logscale
hashMatch("12345678", salt="salt1")