topic Re: How do I mask a pattern using sedcmd in props.conf? in Getting Data In

How do I mask a pattern using sedcmd in props.conf?

prakash007 — Wed, 22 Jun 2016 18:47:44 GMT

How do I replace/mask the pattern below in props.conf..?

pattern
\"password\":\"passtest@123\"

expecting  
\"password\":\"masked\"

Re: How do I mask a pattern using sedcmd in props.conf?

sundareshr — Wed, 22 Jun 2016 18:52:55 GMT

Try this (assuming the backslashes are part of the log)

s/\\("password\\":\\")([^\\]+)(\\")/$1masked$3/g

Re: How do I mask a pattern using sedcmd in props.conf?

prakash007 — Wed, 22 Jun 2016 19:42:05 GMT

Thanks it worked...just for my understanding..why do we use $1 and $3 in there..?

Re: How do I mask a pattern using sedcmd in props.conf?

sundareshr — Wed, 22 Jun 2016 19:46:26 GMT

The original data is captured in 3 groups. The first group ($1) has \"password\":\" the second group has the password and the third group has \". $1masked$2, basically means use whatever is captured in group 1 followed by "masked" followed by whatever is captured in group 3

Re: How do I mask a pattern using sedcmd in props.conf?

ankithreddy777 — Wed, 05 Jul 2017 21:28:13 GMT

For me it is not working. The output raw event is printed as $1masked$3.

Re: How do I mask a pattern using sedcmd in props.conf?

sbbadri — Thu, 06 Jul 2017 14:16:24 GMT

try this . In above use case backslash is present before and after password

s/(\"password\":\")(\S+.*)(\")/$1xxxxxxx$3/g

Re: How do I mask a pattern using sedcmd in props.conf?

ankithreddy777 — Thu, 06 Jul 2017 16:03:24 GMT

my original data is
id=A123 clientid:123456 SSLR

need to mask 123456
I used
s/(clientid\W)(\d+)(\s\w\w\w\w)/$1masked$3/g

my output
id=A123 $1masked$3

Re: How do I mask a pattern using sedcmd in props.conf?

prakash007 — Thu, 06 Jul 2017 16:18:09 GMT

Is this the output you are expecting...??

id=A123 clientid:xxxxxx SSLR

Re: How do I mask a pattern using sedcmd in props.conf?

prakash007 — Thu, 06 Jul 2017 17:45:06 GMT

my original data is
id=A123 clientid:123456 SSLR

need to mask 123456
I used
s/(clientid\W)(\d+)(\s\w\w\w\w)/$1masked$3/g

you can try this....

"s/clientid:(\d+)/clientid:xxxxxx/g"

OUTPUT : id=A128 clientid:xxxxxx SSLR

"s/clientid\:(\d+)\s\S+/xxxxxx/g"

OUTPUT :  id=A128 xxxxxx