Quantcast
Channel: Questions in topic: "props.conf"
Viewing all articles
Browse latest Browse all 1485

How to mask a field value from raw events that shows in multiple patterns

$
0
0
I'm trying to mask a field value for a policy number that is present in my raw logs under different patterns. To explain I'm using a field extraction : EXTRACT-policyNumber = policy.*(-|=)\s(?P\w+) This extracts the policyNumber value for any word that follows a string in my logs that has the word "policy" and anything characters after but has either an = sign or - sign followed by a space before the policyNumber value. I'm trying to add a line in my props.conf to mask any of these values with "X", help appreciated. Here's what I've tried so far : SEDCMD-policyNumber_mask = s/policy.*(-|=)\s(\w+)/policy.*(-|=)\s\"XXXXXXX/g

Viewing all articles
Browse latest Browse all 1485

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>