FNV

Learn about the FNV OTTL converter function.

  less than a minute  

The FNV converter hashes a string using the Fowler-Noll-Vo algorithm.

Syntax: FNV(value)

  • value: the bracket notation location of the string field to hash

Input

{
	"_type": "log",
	"attributes": {
		"decoded_body": "time=1724177404|hostname=CPLPOL32|product=Firewall|layer_name=ENGCORE_MASTER"
	},
	"body": "time=1724177404|hostname=CPLPOL32|product=Firewall|layer_name=ENGCORE_MASTER",
	"resource": {
		"ed.conf.id": "123456789",
		"ed.domain": "pipeline",
		"ed.org.id": "987654321",
		"ed.source.name": "__ed_dummy_test_input",
		"ed.source.type": "memory_input",
		"ed.tag": "loggen",
		"host.ip": "10.0.0.1",
		"host.name": "ED_TEST",
		"service.name": "ed-tester",
		"src_type": "memory_input"
	},
	"timestamp": 1733737798161
}

Statement

set(attributes["body_hash"], FNV(attributes["decoded_body"]))

Output

{
	"_type": "log",
	"attributes": {
		"body_hash": 8015179274000194000,
		"decoded_body": "time=1724177404|hostname=CPLPOL32|product=Firewall|layer_name=ENGCORE_MASTER"
	},
	"body": "time=1724177404|hostname=CPLPOL32|product=Firewall|layer_name=ENGCORE_MASTER",
	"resource": {
		"ed.conf.id": "123456789",
		"ed.domain": "pipeline",
		"ed.org.id": "987654321",
		"ed.source.name": "__ed_dummy_test_input",
		"ed.source.type": "memory_input",
		"ed.tag": "loggen",
		"host.ip": "10.0.0.1",
		"host.name": "ED_TEST",
		"service.name": "ed-tester",
		"src_type": "memory_input"
	},
	"timestamp": 1733737825070
}

The decoded_body attribute was hashed using the FNV algorithm and saved as the body_hash attribute.