Log Fingerprints

Application and infrastructure logs are enormous and repetitive — the same handful of message shapes account for the overwhelming majority of lines, just with different IDs, timings, and values each time. Kloudfuse’s fingerprinting splits every log line into that repeating template and its variable parts, and uses the split both to keep storage efficient and to let you browse by pattern instead of by individual line.

How a fingerprint is generated

During ingestion, the Kf-Parse stage of the parsing pipeline computes a fingerprint for every log line by replacing its variable segments with placeholders. Given:

ts=2023-02-01T22:51:33Z caller=logging.go:29 method=Authorise result=false took=9.775µs

the fingerprint is:

ts=<v_0> caller=<v_1> method=<v_2> result=<v_3> took=<v_4>

and the auto-extracted facets are ts, caller, method, result, and took — see Grammar and JSON logs for how facet extraction works more generally. Storing the template once and the variable values separately, rather than re-indexing the full text of every line, is what keeps Kloudfuse’s highly repetitive log traffic both fully searchable and storage-efficient.

Fingerprints view

The Fingerprints tab (alongside Logs, Timeseries, Table, and the other views — see View tabs) clusters your current search’s results by fingerprint instead of listing them one at a time. Group by a field — source, for example — to see, per group, each distinct fingerprint’s pattern, its occurrence count over the selected time range, and a trend sparkline.

This turns "this source is noisy" into "this source produces these four kinds of lines, and this one just spiked" in one screen, without hunting for a distinguishing substring to search for first. Filter by severity (level="error", for example) before switching to Fingerprints to see, at a glance, every kind of error a system is producing — rather than scrolling through every individual occurrence to notice the same few messages repeating.

A log’s fingerprint is also shown on its own detail pane — so you can pivot from "one interesting line" to "every line that shares its pattern" by copying its fingerprint into a search, or the reverse: start from the Fingerprints view and open one of the underlying lines for full context.

Query fingerprints in FuseQL

In FuseQL, each log’s fingerprint is available as two fields:

Field Contents Filter Group by

__kf_fp_hash

A 16-character hexadecimal hash of the fingerprint, for example d2321dd15f29bb9e.

Yes

Yes

__kf_fp

The fingerprint template, for example ts=<v_0> caller=<v_1> method=<v_2>.

No

No

fp_hash and fingerprint are accepted as aliases for __kf_fp_hash in filters and aggregations. When you group by an alias, the result column takes the alias name.

To find the line shapes that produce the most volume from a source:

source="grafana" | count by (__kf_fp_hash) | sort by _count desc | limit 10
fuseql

To filter on one or more fingerprints, combine the hash with other filters using and. The hash supports equals (=), not equals (!=), and in:

source="grafana" and __kf_fp_hash="d2321dd15f29bb9e"
source="grafana" and __kf_fp_hash!="d2321dd15f29bb9e" | count
source="grafana" and __kf_fp_hash in ("d2321dd15f29bb9e", "529973e21aed70b3") | count
fuseql

To track how many distinct line shapes each source produces over time, which often rises when a deployment adds new code paths or error types:

* | timeslice 5m | count_unique(__kf_fp_hash) by (_timeslice, source)
fuseql

Keep these limits in mind:

  • Regular expressions are not supported on the hash. __kf_fp_hash=~"…​" fails with unsupported operator regex_match on fingerprint.

  • A filter on kf_fp matches no logs, without an error, and grouping by it returns a single null group. Filter and group by kf_fp_hash, and read the template from __kf_fp in the log results.

Raw log results from FuseQL return the fingerprint in the kf_fp and kf_fp_hash columns. Before Release 4.4.0, these columns were named fpString and fpHash. The GraphQL getLogsV2 and getLogsV2Stream APIs still return fpString and fpHash; see Logs API Reference.

When automatic extraction isn’t enough

Fingerprinting and facet extraction are heuristic — accurate for most log formats, but not guaranteed for all of them. When a format needs precise extraction, define a custom grammar (dissect or grok pattern) instead of relying on the automatic heuristic; see Grammar for the configuration reference.