hi i have a data where there are two fields with password which i need to mask via props.conf and also in the search.
the data looks like this : "this is the test message to demonstrate two fields of password abc.password=QWERTYUI and in the same line we also have another password like xyyz.password=Q%1^WRTy."
rex field=_raw mode=sed "s/abc\.password=\w+/abc.password=XXXXXXXX/g"
i was trying my luck in the search first. i cannot do the masking in single rex sed command for both the passwords . i was able to do sucessfully for first one as its not having special characters.
Regards,
Moin
Hi @moin140586,
in your regex I see that you didin't escaped "=", anyway, try something like this:
| makeresults
| eval _raw="this is the test message to demonstrate two fields of password abc.password=QWERTYUI and in the same line we also have another password like xyyz.password=Q%1^WRTy."
| rex mode=sed "s/abc\.password\=\w+.*xyyz\.password\=.*/abc\.password\=********.*xyyz\.password\=********/g"
The regex can be used also in props.conf:
SEDCMD-anonymize = s/abc\.password\=\w+.*xyyz\.password\=.*/abc\.password\=********.*xyyz\.password\=********/g
If you can share a sample of your logs I could be more precise.
Ciao.
Giuseppe