Search code examples
logstashlogstash-grok

Mask a part of creditcard number using logstash grok filter


Trying to mask out a part (6-10th digit) of the 16 digit credit card.

1234567898763456 to 123456######3456

I can think of using gsub filter, but I can't find a way to match the exact section of numbers.

The option would be to split in various sections and then gsub the whole field to '#' and then join back, seems too much work. Any suggestion would be welcome.

Below example would mask all characters, how do I mask selective pattern, from 6th to 10th digit, to get a result like 123456######3456.

filter
{
  mutate {
    gsub => [
      "message","[0-9]{16}","################"   
    ]
  }
}

Solution

  • filter {
        mutate {
        gsub => [
          "message","([0-9]{6})([0-9]{6})([0-9]{4})", "\1######\3"
        ]
      }
    }