Skip to content

Conversation

@ash-darin
Copy link
Contributor

@ash-darin ash-darin commented Jan 9, 2026

Enhancement

Proposed commit message

This changes the fields used to create a unique fingerprint for the event. The currently selected fields are lacking in achieving this as rejects have been observed. Checkpoint apparently often generate events that are "updates" to previous events. These events have the timestamp of the original event but incorporate a "lastupdatetime" timestamp and an update_count. Fingerprint creation therefore creates duplicates.

  • @timestamp is included, but @timestamp is renamed before use and is therefore always nil. -> removed
  • segment_time is not unique, replaced with lastupdatetime
  • add update_count

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.

How to test this PR locally

Check your logs/indices if any messages are rejected. Apply fix and check whether numbers go down..

The fields originally chosen for fingerprinting do not create a unique fingerprint. The new fields create a more unique fingerprint.
just reordering for possible better reading
Updated PR number
@ash-darin ash-darin changed the title Change hash creation [checkpoint] Change hash creation Jan 9, 2026
@ash-darin ash-darin changed the title [checkpoint] Change hash creation [checkpoint] Change fingerprint creation Jan 9, 2026
@andrewkroh andrewkroh added the Integration:checkpoint Check Point label Jan 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants