특정 필드의 해시값(fingerprint)을 구한 후, 숫자(hexnum)로 바꾸는 beat 설정. 기본 해시 알고리즘은 256bit(64자리) 해시값을 만드는 sha256.
processors:
- include_fields:
fields: "winlog"
- fingerprint:
fields: "winlog.event_data.NewProcessName"
- script:
lang: javascript
source: >
function process(evt) {
var str = evt.Get('fingerprint');
var hex = parseInt(str, 16);
evt.Put('hexnum', hex)
}
{
"@timestamp": "2021-05-01T12:52:32.569Z",
"@metadata": {
"beat": "winlogbeat",
"type": "_doc",
"version": "9.4.4"
},
"winlog": {
"record_id": 42811863,
"version": 2,
"channel": "Security",
"task": "Process Creation",
"provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
"computer_name": "MHKANG",
"event_data": {
"TargetUserName": "-",
"NewProcessName": "C:\\Splunk\\bin\\splunk-optimize.exe",
"ProcessId": "0x1eec",
"TargetLogonId": "0x0",
"MandatoryLabel": "S-1-16-16384",
"TokenElevationType": "TokenElevationTypeDefault (1)",
"TargetUserSid": "S-1-0-0",
"TargetDomainName": "-",
"SubjectUserSid": "S-1-5-18",
"SubjectUserName": "MHKANG$",
"SubjectDomainName": "WORKGROUP",
"SubjectLogonId": "0x3e7",
"NewProcessId": "0x768",
"ParentProcessName": "C:\\Splunk\\bin\\splunkd.exe"
},
"event_id": "4688",
"opcode": "Info",
"process": {
"pid": 4,
"thread": {
"id": 17324
}
},
"provider_name": "Microsoft-Windows-Security-Auditing",
"keywords": [
"Audit Success"
]
},
"fingerprint": "3d0a581fef359b97efff2d87e36967e71faaa0ba6921b407cc563a57292b662f",
"hexnum": 2.760936044885559e+76
}
런타임 필드는 숫자 변환 실패.
GET winlogbeat-9.4.4/_search
{
"size": 1,
"_source": false,
"query": {
"term": {"_id": "tjHwuJ8B5vno4AgHkt20"}
},
"fields": ["fingerprint", "hexnum"],
"runtime_mappings": {
"hexnum": {
"type": "long",
"script": {
"source": """
emit(Long.parseUnsignedLong(doc['fingerprint'].value, 16));
"""
}
}
}
}
{
"error": {
"root_cause": [
{
"type": "script_exception",
"reason": "runtime error",
"script_stack": [
"java.base/java.lang.Long.parseUnsignedLong(Long.java:751)",
"""emit(Long.parseUnsignedLong(doc['fingerprint'].value, 16));
""",
" ^---- HERE"
],
"script": " ...",
"lang": "painless",
"position": {
"offset": 58,
"start": 12,
"end": 81
}
}
],
"type": "search_phase_execution_exception",
"reason": "all shards failed",
"phase": "query",
"grouped": true,
"failed_shards": [
{
"shard": 0,
"index": ".ds-winlogbeat-9.4.4-2026.07.25-000001",
"node": "JwAU_huAQPKGzn0YtEn05g",
"reason": {
"type": "script_exception",
"reason": "runtime error",
"script_stack": [
"java.base/java.lang.Long.parseUnsignedLong(Long.java:751)",
"""emit(Long.parseUnsignedLong(doc['fingerprint'].value, 16));
""",
" ^---- HERE"
],
"script": " ...",
"lang": "painless",
"position": {
"offset": 58,
"start": 12,
"end": 81
},
"caused_by": {
"type": "number_format_exception",
"reason": "String value 7a0d5bf90750f6e1d729e0f97604ab778b576fe74ee5f294263d5cfe3e102e5f exceeds range of unsigned long."
}
}
}
]
},
"status": 400
}
해시값이 너무 길어?
길이가 가장 짧은 xxhash 알고리즘으로 변경.
processors:
- include_fields:
fields: "winlog"
- fingerprint:
fields: "winlog.event_data.NewProcessName"
method: "xxhash"
- script:
lang: javascript
source: >
function process(evt) {
var str = evt.Get('fingerprint');
var hex = parseInt(str, 16);
evt.Put('hexnum', hex)
}
런타임 필드는 64bit(16자리) 해시까지만 숫자 변환이 가능한 모양.
GET winlogbeat-9.4.4/_search
{
"size": 1,
"_source": false,
"query": {
"term": {"_id": "-zGFuZ8B5vno4AgHPufo"}
},
"fields": ["fingerprint", "hexnum"],
"runtime_mappings": {
"hexnum": {
"type": "long",
"script": {
"source": """
emit(Long.parseUnsignedLong(doc['fingerprint'].value, 16));
"""
}
}
}
}
{
"took": 1,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"skipped": 0,
"failed": 0
},
"hits": {
"total": {
"value": 1,
"relation": "eq"
},
"max_score": 1,
"hits": [
{
"_index": ".ds-winlogbeat-9.4.4-2026.07.25-000001",
"_id": "-zGFuZ8B5vno4AgHPufo",
"_score": 1,
"fields": {
"hexnum": [
-5252739138666392000
],
"fingerprint": [
"b71a859565ff9738"
]
}
}
]
}
}
댓글 없음:
댓글 쓰기