diff --git a/docs/index.asciidoc b/docs/index.asciidoc index 96e432d..3f9380a 100644 --- a/docs/index.asciidoc +++ b/docs/index.asciidoc @@ -27,9 +27,6 @@ This can e.g. be used to create consistent document ids when inserting events into Elasticsearch, allowing events in Logstash to cause existing documents to be updated rather than new documents to be created. -NOTE: When using any method other than 'UUID', 'PUNCTUATION' or 'MURMUR3' -you must set the key, otherwise the plugin will raise an exception - NOTE: When the `target` option is set to `UUID` the result won't be a consistent hash but a random https://en.wikipedia.org/wiki/Universally_unique_identifier[UUID]. @@ -99,8 +96,7 @@ source fields given. * There is no default value for this setting. When used with the `IPV4_NETWORK` method fill in the subnet prefix length. -Key is required with all methods except `MURMUR3`, `PUNCTUATION` or `UUID`. -With other methods fill in the HMAC key. +With other methods, optionally fill in the HMAC key. [id="plugins-{type}s-{plugin}-method"] ===== `method` @@ -111,10 +107,12 @@ With other methods fill in the HMAC key. The fingerprint method to use. -If set to `SHA1`, `SHA256`, `SHA384`, `SHA512`, or `MD5` the -cryptographic keyed-hash function with the same name will be used to -generate the fingerprint. If set to `MURMUR3` the non-cryptographic -MurmurHash function will be used. +If set to `SHA1`, `SHA256`, `SHA384`, `SHA512`, or `MD5` and a key is set, +the cryptographic hash function with the same name will be used to generate +the fingerprint. When a key set, the keyed-hash (HMAC) digest function will +be used. + +If set to `MURMUR3` the non-cryptographic MurmurHash function will be used. If set to `IPV4_NETWORK` the input data needs to be a IPv4 address and the hash value will be the masked-out address using the number of bits diff --git a/lib/logstash/filters/fingerprint.rb b/lib/logstash/filters/fingerprint.rb index deb8213..6df1361 100644 --- a/lib/logstash/filters/fingerprint.rb +++ b/lib/logstash/filters/fingerprint.rb @@ -34,8 +34,7 @@ class LogStash::Filters::Fingerprint < LogStash::Filters::Base config :target, :validate => :string, :default => 'fingerprint' # When used with the `IPV4_NETWORK` method fill in the subnet prefix length. - # Key is required with all methods except `MURMUR3`, `PUNCTUATION` or `UUID`. - # With other methods fill in the HMAC key. + # With other methods, optionally fill in the HMAC key. config :key, :validate => :string # When set to `true`, the `SHA1`, `SHA256`, `SHA384`, `SHA512` and `MD5` fingerprint methods will produce @@ -44,10 +43,12 @@ class LogStash::Filters::Fingerprint < LogStash::Filters::Base # The fingerprint method to use. # - # If set to `SHA1`, `SHA256`, `SHA384`, `SHA512`, or `MD5` the - # cryptographic keyed-hash function with the same name will be used to - # generate the fingerprint. If set to `MURMUR3` the non-cryptographic - # MurmurHash function will be used. + # If set to `SHA1`, `SHA256`, `SHA384`, `SHA512`, or `MD5` and a key is set, + # the cryptographic hash function with the same name will be used to generate + # the fingerprint. When a key set, the keyed-hash (HMAC) digest function will + # be used. + # + # If set to `MURMUR3` the non-cryptographic MurmurHash function will be used. # # If set to `IPV4_NETWORK` the input data needs to be a IPv4 address and # the hash value will be the masked-out address using the number of bits @@ -98,14 +99,6 @@ class << self; alias_method :fingerprint, :fingerprint_murmur3; end when :PUNCTUATION # nothing else - if @key.nil? - raise LogStash::ConfigurationError, I18n.t( - "logstash.runner.configuration.invalid_plugin_register", - :plugin => "filter", - :type => "fingerprint", - :error => "Key value is empty. Please fill in an encryption key" - ) - end class << self; alias_method :fingerprint, :fingerprint_openssl; end @digest = select_digest(@method) end @@ -161,11 +154,19 @@ def fingerprint_ipv4_network(ip_string) def fingerprint_openssl(data) # in JRuby 1.7.11 outputs as ASCII-8BIT - if @base64encode - hash = OpenSSL::HMAC.digest(@digest, @key, data.to_s) - Base64.strict_encode64(hash).force_encoding(Encoding::UTF_8) + if @key.nil? + if @base64encode + @digest.base64digest(data.to_s).force_encoding(Encoding::UTF_8) + else + @digest.hexdigest(data.to_s).force_encoding(Encoding::UTF_8) + end else - OpenSSL::HMAC.hexdigest(@digest, @key, data.to_s).force_encoding(Encoding::UTF_8) + if @base64encode + hash = OpenSSL::HMAC.digest(@digest, @key, data.to_s) + Base64.strict_encode64(hash).force_encoding(Encoding::UTF_8) + else + OpenSSL::HMAC.hexdigest(@digest, @key, data.to_s).force_encoding(Encoding::UTF_8) + end end end