Access log masking

[jalaziz]

In some scenarios, sensitive information must be passed via query strings. It would be great if Unit had support for applying masking rules when writing access logs. A simple version of this would be a regex match and replace.

This is currently possible in nginx using a combination of map and log_format.

[hongzhidao]

Hi, There is a patch of custom log format in the internal review, it also supports variables.

[jalaziz]

There is a patch of custom log format in the internal review, it also supports variables.

Great! Does it include support for modifying/masking variables or just including/excluding them? In the masking use case we have, we'd like to include the query string in most cases, but only mask out the sensitive data.

[hongzhidao]

Yes, users can modify built-in variables like uri and create custom variables by regex named captures. For example:

{
       "match": {"uri": "~(?<uri>.*)/salt"},
}