Unable to mask data with regex

[cborchgrevink]

Example Log:

CEF:0|WAF|SIEMintegration|1|1|Normal|0| fileId=989000730114151753 sourceServiceName=website.com postbody=first_name\=XXXXXX&last_name\=XXXX&shipping_first_name\=ABCDE&shipping_last_name\=EFGHI&record_number\=123412345

I am having trouble getting my regex in transforms.conf to mask:
1. shipping_first_name
2. shipping_last_name
3. record_number

Transforms.conf

[record-anonymizer]
REGEX = (?m)^(.*)record_number..\d{2,}$
FORMAT = $1rn=##
DEST_KEY = _raw

[first-name-anonymizer]
REGEX = (?m)^(.*)shipping_first_name..(\w{2,})&$
FORMAT = $1fn=##$
DEST_KEY = _raw

[last-name-anonymizer]
REGEX = (?m)^(.*)shipping_last_name..(\w{2,})&$
FORMAT = $1ln=##$
DEST_KEY = _raw

props.conf

[Test]
TRANSFORMS-anonymize = record-anonymizer, first-name-anonymizer, last-name-anonymizer

[tom_frotscher]

Hi,

i tried to use your regex with regex101 and they do not match correctly. What you want, is a regex that captures everything up to the string you want to mask, and everything behind. Then, in the FORMAT field you use the first capture group, set your mask in the middle and use the secodn capture group.

Try this:

[record-anonymizer]
REGEX = (?m)^(.*)record_number\\\=\d+(.*)$
FORMAT = $1record_number=##$2
DEST_KEY = _raw

[first-name-anonymizer]
REGEX = (?m)^(.*)shipping_first_name\\\=\w+(&.*)$
FORMAT = $1shipping_first_name=##$2
DEST_KEY = _raw

[last-name-anonymizer]
REGEX = (?m)^(.*)shipping_last_name\\\=\w+(&.*)$
FORMAT = $1shipping_last_name=##$2
DEST_KEY = _raw

Greetings
Tom

[pruthvikrishnap]

Try this

[my_sourctype]
[source::/path/to/my/logs]
SEDCMD-remove_secret_data = regex`enter code here