Masking sensitive logs using regex

Viewed 192

I am trying to mask the logs by chaining replace regex in logback.xml file.

%replace(%replace(%msg){'"email":(.*?),','"email":"****"'}){'"phone":(.*?),','"phone":"****"'})) 

It's working, but is there any other regex solution instead of regex replace chaining?

Can we use regex something like this?

(%replace(%msg){'"(email|phone)":(:*?)','"***",'}

I tried the above but the format is not proper.

Required output is:

{"email":"****","phone":"****"}
1 Answers

You can use

(%replace(%msg){'"(email|phone)":[^,]*,?','"$1":"****"'})

The "(email|phone)":[^,]*,? regex matches

  • " - a " char
  • (email|phone) - Group 1 ($1): email or phone string
  • ": - a ": string
  • [^,]* - zero or more chars other than a comma
  • ,? - an optional , char.

The replacement is "$1":"****": " + Group 1 value + ":"***".

See the regex demo.

Related