is it possible to mask partially with logstash-logback-encoder

Question

I have to mask in logs sensitive info, but only partially. For example I need to replace email '[email protected]' with 'k***@e***' Is it possible to do this with logstash-logback-encoder?

Currently I use this logback.xml:

<configuration>
    <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">

        <encoder class="net.logstash.logback.encoder.LogstashEncoder">
            <fieldNames>
                <timestamp>timestamp</timestamp>
            </fieldNames>
        </encoder>
        <!-- see https://github.com/logfellow/logstash-logback-encoder#identifying-field-values-to-mask-by-value -->
        <encoder class="net.logstash.logback.encoder.LogstashEncoder">
            <jsonGeneratorDecorator class="net.logstash.logback.mask.MaskingJsonGeneratorDecorator">
                <value>(\w+@\w+\.\w+)</value>
                <path>message/*</path>
            </jsonGeneratorDecorator>
        </encoder>
    </appender>
    <root level="info">
        <appender-ref ref="CONSOLE"/>
    </root>
</configuration>

And with it I get:

{"@timestamp":"2021-12-21T17:17:15.072+02:00","@version":"1","message":"email=********)]","logger_name":"org.ba.SpringLogginProcessingExampleApplication","thread_name":"main","level":"INFO","level_value":20000}

I'd prefer to have LogEvent(email=k****@e*** vs email=****

Answer 1

Yes. The mask can reference capturing groups in the value regex.

Something like this:

    <valueMask>
        <value>(\w)\w*@(\w)\w*\.(\w)\w*</value>
        <mask>$1****@$2****.$3****</mask>
    </valueMask>