I have to mask in logs sensitive info, but only partially. For example I need to replace email 'kate@example.com' with 'k***@e***' Is it possible to do this with logstash-logback-encoder?
Currently I use this logback.xml:
<configuration>
<appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
<encoder class="net.logstash.logback.encoder.LogstashEncoder">
<fieldNames>
<timestamp>timestamp</timestamp>
</fieldNames>
</encoder>
<!-- see https://github.com/logfellow/logstash-logback-encoder#identifying-field-values-to-mask-by-value -->
<encoder class="net.logstash.logback.encoder.LogstashEncoder">
<jsonGeneratorDecorator class="net.logstash.logback.mask.MaskingJsonGeneratorDecorator">
<value>(\w+@\w+\.\w+)</value>
<path>message/*</path>
</jsonGeneratorDecorator>
</encoder>
</appender>
<root level="info">
<appender-ref ref="CONSOLE"/>
</root>
</configuration>
And with it I get:
{"@timestamp":"2021-12-21T17:17:15.072+02:00","@version":"1","message":"email=********)]","logger_name":"org.ba.SpringLogginProcessingExampleApplication","thread_name":"main","level":"INFO","level_value":20000}
I'd prefer to have LogEvent(email=k****@e*** vs email=****
Yes. The mask can reference capturing groups in the value regex.
Something like this:
<valueMask>
<value>(\w)\w*@(\w)\w*\.(\w)\w*</value>
<mask>$1****@$2****.$3****</mask>
</valueMask>