data masking not working at index time

[kranthimutyala]

Hi Guys,
I have the below sample data , i want to mask the string after Basic and tried below transforms.conf and sed but both didnt work.Can somepne help me with masking the string

*/*\r\nAuthorization: Basic **YxBshshhggdhfhjhaskfjhkjf**==\r\Proxy-Authorization: Basic **TkfjksfjksjggkdjkgjkshfjhfjhHhdjahj**==\r\n
*/*\r\nAuthorization: Basic **rxBshshhdhfhjhaskfjhkjf**==\r\Proxy-Authorization: Basic **TdsdsskfjksfjksjgkshfjhfjhHhdjahj**==\r\n

[f5:test]
SEDCMD-anonymizeip = s/Authorization: Basic(?:\s([a-zA-Z]{0,50}==))/XXX.XXX.XXX.XXX/g

[session-anonymizer]
REGEX = (nAuthorization:\s*Basic\s*(?\w+)==)
FORMAT = $1test1xxxxxx$2
WRITE_META = true
DEST_KEY = _raw

[ticket-anonymizer]
REGEX = (Proxy-Authorization:\s*Basic\s*(?\w+)==)
FORMAT = $1test2xxxxxxx$2
WRITE_META = true
DEST_KEY = _raw

[damann]

As FrankVI already mentioned your SED regex doesnt match your sample events.

I played a little around with SED and came to this solution:

echo "*/*\r\nAuthorization: Basic **YxBshshhggdhfhjhaskfjhkjf**==\r\Proxy-Authorization: Basic **TkfjksfjksjggkdjkgjkshfjhfjhHhdjahj**==\r\n" |  sed 's/\(Basic\s\*\*\)\([a-zA-Z]*\)/\1XXX/g'

This outputs to

*/*\r\nAuthorization: Basic **XXX**==\r\Proxy-Authorization: Basic **XXX**==\r\n

I hope it helps

[FrankVl]

Regarding the SED command:
Do your events actually contain those plain \r\n strings and also the ** bits?

If so, your SED regex does not match. If not, please clarify your sample events.

Also: keep in mind that the SED command replaces the entire string that matches with the XXX pattern. So it not only masks what is in the capture group, but also the "Authorization: Basic" before it.

Regarding the transforms:
The regex is invalid, (?\w+) is not valid REGEX syntax.
Not sure what exactly you are trying to do here, but overwriting the whole _raw in this way probably destroys most of your event content. (if it wasn't for the broken regex syntax, that prevents this bit from being applied altogether).