I'm trying to mask a field value for a policy number that is present in my raw logs under different patterns. To explain I'm using a field extraction :
EXTRACT-policyNumber = policy.*(-|=)\s(?P\w+)
This extracts the policyNumber value for any word that follows a string in my logs that has the word "policy" and anything characters after but has either an = sign or - sign followed by a space before the policyNumber value.
I'm trying to add a line in my props.conf to mask any of these values with "X", help appreciated. Here's what I've tried so far :
SEDCMD-policyNumber_mask = s/policy.*(-|=)\s(\w+)/policy.*(-|=)\s\"XXXXXXX/g
↧