# encoding: utf-8 require "logstash/filters/base" require 'securerandom' # This filter will replace the contents of the default # message field with whatever you specify in the configuration. # # It is only intended to be used as an . class LogStash::Filters::Mask < LogStash::Filters::Base # Setting the config_name here is required. This is how you # configure this filter from your Logstash config. # # filter { # { # message => "My message..." # } # } # config_name "mask" # Replace the message with this value. config :keys_to_mask, :validate => :string, :default => nil config :mask_key, :validate => :string, :default => "*****" config :message, :validate => :string, :default => "message" public def register # Add instance variables end # def register public def filter(event) data = event.get(@message) if @keys_to_mask.nil? || @keys_to_mask.empty? raise "keys_to_mask missing" end keys = keys_to_mask.to_s.split(",") logs = data['logs'] mLogs = logs.map do |log| # This if condition is to avoid any boolean or strng type value in array of logs object # as it is not a valid values if !log.is_a?(FalseClass) && !log.is_a?(TrueClass) && !log.is_a?(String) message = log['message'] if log["mask"] == "maskAll" && log["type"].match(/input|output/) log = maskLog(log) elsif log["type"].match(/input/) log["message"] = maskTokens(keys, message) end log["uid"] = "log-#{SecureRandom.uuid}" log end end mLogs = mLogs.compact mLogs.compact event.set("message", mLogs) # filter_matched should go in the last line of our successful code filter_matched(event) end # def filter def maskLog(data) if data["type"] == "input" data["message"] = "Input data is masked" elsif data["type"] == "output" data["message"] = "Output data is masked" end return data end def maskTokens(keys, message) begin message = JSON.parse(message) rescue return message end for i in keys do if !message[i].nil? message[i] = mask_key end end return message.to_json end end # class LogStash::Filters::Mask