<div id="readability-page-1" class="page"><div id="post-body-4476434816278325777" itemprop="articleBody">
특정 필드의 해시값(fingerprint)을 구한 후, 숫자(hexnum)로 바꾸는 beat 설정. 기본 해시 알고리즘은 256bit(64자리) 해시값을 만드는 sha256.<div>processors:- include_fields:fields: "winlog"- fingerprint:fields: "winlog.event_data.NewProcessName"- script:lang: javascriptsource: &gt;function process(evt) {var str = evt.Get('fingerprint');var hex = parseInt(str, 16);evt.Put('hexnum', hex)}</div><div>{"@timestamp": "2021-05-01T12:52:32.569Z","@metadata": {"beat": "winlogbeat","type": "_doc","version": "9.4.4"&nbsp; },"winlog": {"record_id": 42811863,"version": 2,"channel": "Security","task": "Process Creation","provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}","computer_name": "MHKANG","event_data": {"TargetUserName": "-","NewProcessName": "C:\\Splunk\\bin\\splunk-optimize.exe","ProcessId": "0x1eec","TargetLogonId": "0x0","MandatoryLabel": "S-1-16-16384","TokenElevationType": "TokenElevationTypeDefault (1)","TargetUserSid": "S-1-0-0","TargetDomainName": "-","SubjectUserSid": "S-1-5-18","SubjectUserName": "MHKANG$","SubjectDomainName": "WORKGROUP","SubjectLogonId": "0x3e7","NewProcessId": "0x768","ParentProcessName": "C:\\Splunk\\bin\\splunkd.exe"&nbsp; &nbsp; },"event_id": "4688","opcode": "Info","process": {"pid": 4,"thread": {"id": 17324&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; },"provider_name": "Microsoft-Windows-Security-Auditing","keywords": ["Audit Success"&nbsp; &nbsp; ]&nbsp; },"fingerprint": "3d0a581fef359b97efff2d87e36967e71faaa0ba6921b407cc563a57292b662f","hexnum": 2.760936044885559e+76}</div>런타임 필드는 숫자 변환 실패.<div>GET winlogbeat-9.4.4/_search{"size": 1,"_source": false,"query": {"term": {"_id": "tjHwuJ8B5vno4AgHkt20"}&nbsp; },"fields": ["fingerprint", "hexnum"],"runtime_mappings": {"hexnum": {"type": "long","script": {"source": """&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; emit(Long.parseUnsignedLong(doc['fingerprint'].value, 16));&nbsp; &nbsp; &nbsp; &nbsp; """&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; }}</div>

<div>{"error": {"root_cause": [&nbsp; &nbsp; &nbsp; {"type": "script_exception","reason": "runtime error","script_stack": ["java.base/java.lang.Long.parseUnsignedLong(Long.java:751)","""emit(Long.parseUnsignedLong(doc['fingerprint'].value, 16));&nbsp; &nbsp; &nbsp; &nbsp; """," &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;^---- HERE"&nbsp; &nbsp; &nbsp; &nbsp; ],"script": " ...","lang": "painless","position": {"offset": 58,"start": 12,"end": 81&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; ],"type": "search_phase_execution_exception","reason": "all shards failed","phase": "query","grouped": true,"failed_shards": [&nbsp; &nbsp; &nbsp; {"shard": 0,"index": ".ds-winlogbeat-9.4.4-2026.07.25-000001","node": "JwAU_huAQPKGzn0YtEn05g","reason": {"type": "script_exception","reason": "runtime error","script_stack": ["java.base/java.lang.Long.parseUnsignedLong(Long.java:751)","""emit(Long.parseUnsignedLong(doc['fingerprint'].value, 16));&nbsp; &nbsp; &nbsp; &nbsp; """," &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;^---- HERE"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ],"script": " ...","lang": "painless","position": {"offset": 58,"start": 12,"end": 81&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },"caused_by": {"type": "number_format_exception","reason": "String value 7a0d5bf90750f6e1d729e0f97604ab778b576fe74ee5f294263d5cfe3e102e5f exceeds range of unsigned long."&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; ]&nbsp; },"status": 400}</div><h2>해시값이 너무 길어?&nbsp;</h2>길이가 가장 짧은 <a href="https://www.elastic.co/docs/reference/beats/winlogbeat/fingerprint" target="_blank">xxhash</a> 알고리즘으로 변경.<div>processors:- include_fields:fields: "winlog"- fingerprint:fields: "winlog.event_data.NewProcessName"method: "xxhash"- script:lang: javascriptsource: &gt;function process(evt) {var str = evt.Get('fingerprint');var hex = parseInt(str, 16);evt.Put('hexnum', hex)}</div>런타임 필드는 64bit(16자리) 해시까지만 숫자 변환이 가능한 모양.<div>GET winlogbeat-9.4.4/_search{"size": 1,"_source": false,"query": {"term": {"_id": "-zGFuZ8B5vno4AgHPufo"}&nbsp; },"fields": ["fingerprint", "hexnum"],"runtime_mappings": {"hexnum": {"type": "long","script": {"source": """&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; emit(Long.parseUnsignedLong(doc['fingerprint'].value, 16));&nbsp; &nbsp; &nbsp; &nbsp; """&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; }}</div><div>{"took": 1,"timed_out": false,"_shards": {"total": 1,"successful": 1,"skipped": 0,"failed": 0&nbsp; },"hits": {"total": {"value": 1,"relation": "eq"&nbsp; &nbsp; },"max_score": 1,"hits": [&nbsp; &nbsp; &nbsp; {"_index": ".ds-winlogbeat-9.4.4-2026.07.25-000001","_id": "-zGFuZ8B5vno4AgHPufo","_score": 1,"fields": {"hexnum": [-5252739138666392000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ],"fingerprint": ["b71a859565ff9738"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ]&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; ]&nbsp; }}</div><div>관련 글<div><ul><li><a href="https://kangmyounghun.blogspot.com/2025/08/runtime-field-13th.html">엘라스틱 Runtime field - 13th</a></li><li><a href="https://kangmyounghun.blogspot.com/2021/03/712.html" target="">엘라스틱 Runtime field</a></li><li><a href="http://kangmyounghun.blogspot.com/2018/07/elasticsearch-scripted-field.html" target="">엘라스틱 Sscripted field</a></li><li><a href="https://kangmyounghun.blogspot.com/2021/09/2nd.html" target="">정규표현식 몰라도 된다 - 2nd</a></li><li><a href="https://kangmyounghun.blogspot.com/2023/09/convert-ip-to-decimal.html">convert ip to decimal</a></li></ul></div></div>

</div></div>

케세라세라

특정 필드의 해시값(fingerprint)을 구한 후, 숫자(hexnum)로 바꾸는 beat 설정. 기본 해시 알고리즘은 256bit(64자리) 해시값을 만드는 sha256.
processors:
  - include_fields:
      fields: "winlog"
  - fingerprint:
      fields: "winlog.event_data.NewProcessName"
  - script:
      lang: javascript
      source: >
        function process(evt) {
          var str = evt.Get('fingerprint');
          var hex = parseInt(str, 16);
          evt.Put('hexnum', hex)
        }
{
  "@timestamp": "2021-05-01T12:52:32.569Z",
  "@metadata": {
    "beat": "winlogbeat",
    "type": "_doc",
    "version": "9.4.4"
  },
  "winlog": {
    "record_id": 42811863,
    "version": 2,
    "channel": "Security",
    "task": "Process Creation",
    "provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
    "computer_name": "MHKANG",
    "event_data": {
      "TargetUserName": "-",
      "NewProcessName": "C:\\Splunk\\bin\\splunk-optimize.exe",
      "ProcessId": "0x1eec",
      "TargetLogonId": "0x0",
      "MandatoryLabel": "S-1-16-16384",
      "TokenElevationType": "TokenElevationTypeDefault (1)",
      "TargetUserSid": "S-1-0-0",
      "TargetDomainName": "-",
      "SubjectUserSid": "S-1-5-18",
      "SubjectUserName": "MHKANG$",
      "SubjectDomainName": "WORKGROUP",
      "SubjectLogonId": "0x3e7",
      "NewProcessId": "0x768",
      "ParentProcessName": "C:\\Splunk\\bin\\splunkd.exe"
    },
    "event_id": "4688",
    "opcode": "Info",
    "process": {
      "pid": 4,
      "thread": {
        "id": 17324
      }
    },
    "provider_name": "Microsoft-Windows-Security-Auditing",
    "keywords": [
      "Audit Success"
    ]
  },
  "fingerprint": "3d0a581fef359b97efff2d87e36967e71faaa0ba6921b407cc563a57292b662f",
  "hexnum": 2.760936044885559e+76
}
런타임 필드는 숫자 변환 실패.
GET winlogbeat-9.4.4/_search
{
  "size": 1,
  "_source": false,
  "query": {
    "term": {"_id": "tjHwuJ8B5vno4AgHkt20"}
  },
  "fields": ["fingerprint", "hexnum"],
  "runtime_mappings": {
    "hexnum": {
      "type": "long",
      "script": {
        "source": """
          emit(Long.parseUnsignedLong(doc['fingerprint'].value, 16));
        """
      }
    }
  }
}
{
  "error": {
    "root_cause": [
      {
        "type": "script_exception",
        "reason": "runtime error",
        "script_stack": [
          "java.base/java.lang.Long.parseUnsignedLong(Long.java:751)",
          """emit(Long.parseUnsignedLong(doc['fingerprint'].value, 16));
        """,
          "                                              ^---- HERE"
        ],
        "script": " ...",
        "lang": "painless",
        "position": {
          "offset": 58,
          "start": 12,
          "end": 81
        }
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
        "shard": 0,
        "index": ".ds-winlogbeat-9.4.4-2026.07.25-000001",
        "node": "JwAU_huAQPKGzn0YtEn05g",
        "reason": {
          "type": "script_exception",
          "reason": "runtime error",
          "script_stack": [
            "java.base/java.lang.Long.parseUnsignedLong(Long.java:751)",
            """emit(Long.parseUnsignedLong(doc['fingerprint'].value, 16));
        """,
            "                                              ^---- HERE"
          ],
          "script": " ...",
          "lang": "painless",
          "position": {
            "offset": 58,
            "start": 12,
            "end": 81
          },
          "caused_by": {
            "type": "number_format_exception",
            "reason": "String value 7a0d5bf90750f6e1d729e0f97604ab778b576fe74ee5f294263d5cfe3e102e5f exceeds range of unsigned long."
          }
        }
      }
    ]
  },
  "status": 400
}
해시값이 너무 길어? 
길이가 가장 짧은 xxhash 알고리즘으로 변경.
processors:
  - include_fields:
      fields: "winlog"
  - fingerprint:
      fields: "winlog.event_data.NewProcessName"
      method: "xxhash"
  - script:
      lang: javascript
      source: >
        function process(evt) {
          var str = evt.Get('fingerprint');
          var hex = parseInt(str, 16);
          evt.Put('hexnum', hex)
        }
런타임 필드는 64bit(16자리) 해시까지만 숫자 변환이 가능한 모양.
GET winlogbeat-9.4.4/_search
{
  "size": 1,
  "_source": false,
  "query": {
    "term": {"_id": "-zGFuZ8B5vno4AgHPufo"}
  },
  "fields": ["fingerprint", "hexnum"],
  "runtime_mappings": {
    "hexnum": {
      "type": "long",
      "script": {
        "source": """
          emit(Long.parseUnsignedLong(doc['fingerprint'].value, 16));
        """
      }
    }
  }
}
{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 1,
      "relation": "eq"
    },
    "max_score": 1,
    "hits": [
      {
        "_index": ".ds-winlogbeat-9.4.4-2026.07.25-000001",
        "_id": "-zGFuZ8B5vno4AgHPufo",
        "_score": 1,
        "fields": {
          "hexnum": [
            -5252739138666392000
          ],
          "fingerprint": [
            "b71a859565ff9738"
          ]
        }
      }
    ]
  }
}
관련 글
엘라스틱 Runtime field - 13th
엘라스틱 Runtime field
엘라스틱 Sscripted field
정규표현식 몰라도 된다 - 2nd
convert ip to decimal

엘라스틱 Runtime field - 14th

댓글