hashMatch( ) Query Function

Calculates a secure hash of a field and uses that to match events as a filter. See hashRewrite() on how get hashes into events. bits must be set to the value applied when the hash was stored in the event.

Parameters

Name Type Required Default Description
input string Yes A constant value to hash and then apply as the search term
field string No The name of the field to look for an exact match against. If not set then @rawstring is searched for a matching substring.
salt string Yes The name of the secret salt to use.
hash string No sha256 Hash algorithm. Supported: sha256 and sha512.
bits number No 256 Hash algorithm output bits to keep. Must be a multiple of 8 in the range 8 - 512.

input is the unnamed parameter.

Examples

Filter events to only match those that have the value in the ssn field equal to the hash of 12345678

ssn =~ hashMatch("12345678", salt="salt1")

Filter events to only match those that have the value of the hash of 12345678 somewhere in @rawstring

hashMatch("12345678", salt="salt1")