How to hide part of a message in ELK?

Question

elasticsearch

Is there a way in ELK to hide the password part of the message? for example change by regular expression.

I know that you can do something like this through logstash filters

if [action] == "login" {
    mutate { remove_field => "secret" }
  }

But I would like something more serious to leave part of the message and remove only the password.

Answer 1

In general, you need to add if in the filter with a regular expression and, through the mutate module, replace the regular expression inside this message.
Example:

if [message] =~ "statement: ((?i)alter|(?i)create) ((?i)user|(?i)role)" {
      mutate {
        gsub => [
          "message", "'.*'", "'******'"
        ]
      }
    }