A method will be to use a field extraction to get the value of the hash from each event.
Then pick a timerange and get the first and last hash of the events and add some logic.
Finally setup an alert on the number of results > 0
| rex "version \d+\.\d+.(|\d+)//(?<hash>[\w\d]*)"
| stats latest(_time) as _time latest(hash) AS newhash earliest(hash) AS oldhash
| WHERE NOT newhash=oldhash
| table _time newhash