hashMatch() Query Function

Calculates a secure hash of a field and uses that to match events as a filter. See hashRewrite() on how get hashes into events. bits must be set to the value applied when the hash was stored in the event.

Parameters

Name

Type

Required

Default

Description

input

string

Yes

A constant value to hash and then apply as the search term.

field

string

No

The name of the field to look for an exact match against. If not set then @rawstring is searched for a matching substring.

salt

string

No

The name of the secret salt to use.

hash

string

No

sha256

Hash algorithm. Supported: sha256 and sha512.

bits

number

No

256

Hash algorithm output bits to keep. Must be a multiple of 8 in the range 8 - 512.

The implied parameter is input.

Examples

Filter events to only match those that have the value in the ssn field equal to the hash of 12345678

humio
ssn =~ hashMatch("12345678", salt="salt1")

Filter events to only match those that have the value of the hash of 12345678 somewhere in @rawstring

humio
hashMatch("12345678", salt="salt1")