logstash 对敏感信息脱敏

weixin_43815019

已于 2024-05-09 14:17:27 修改

阅读量343

点赞数 10

文章标签： kafka elk 运维

于 2024-05-07 19:03:49 首次发布

本文链接：https://blog.csdn.net/weixin_43815019/article/details/138541437

版权

使用 mutate 过滤器插件中的 gsub

将 request.body 内容中 password 关键字之后的内容替换为 ******** 达到脱敏效果

filter {
  mutate { 
    gsub => [
      "[request][body]", "(\"password\":\")(.*?)(\")", "\1********\3",
      "[request][body]", "(password=)(.*?)(&|$)", "\1********\3",
      "[response][headers][set-cookie]", ".*", "\1********\3",
      "[response][body]", "(\"token\":\")(.*?)(\")", "\1********\3"
    ]
  }
}

示例日志

{
  "client_ip": "0.0.0.0",
  "latency": 32.999992370605,
  "@timestamp": "2024-05-07T11:57:58.841Z",
  "upstream_latency": 33,
  "apisix_latency": 0,
  "route_id": "aaaaaa",
  "request": {
    "body": "{\"name\":\"test\",\"password\":\"abcdefghijk@test\"}"
  },
  "kafka": {
    "partition": 4,
    "topic": "apisix_log_ali_pro",
    "offset": 18058195
  }
}