# Code review: masking credit card numbers

**URL:** <https://discuss.elastic.co/t/code-review-masking-credit-card-numbers/46507>\
**Category:** Logstash\
**Created:** [April 6, 2016, 9:50am UTC](https://discuss.elastic.co/t/code-review-masking-credit-card-numbers/46507 "2016-04-06T09:50:51Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alex\_6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_6/32/1330_2.png) [@Alex\_6](https://discuss.elastic.co/u/Alex_6)\
**Post date:** [April 6, 2016, 9:50am UTC](https://discuss.elastic.co/t/code-review-masking-credit-card-numbers/46507/1 "2016-04-06T09:50:51Z")

</div>

We have a failsafe to mask credit card numbers just in case they appear in a log (they shouldn't but...). We have a Grok pattern for credit card numbers and want to replace any occurrences of that with 16 X's.

```
# Check for credit card numbers and then replace them with XXXX...
grok {
  patterns_dir => "/etc/logstash/conf.d/patterns"
  match => { "message" => "%{GREEDYDATA:ccPart1}%{CREDITCARDNUMBER:ccNumber}%{GREEDYDATA:ccPart2}" }
  add_tag => ["ccDetected"]
  tag_on_failure => []
}
if "ccDetected" in [tags] {
  if ![ccPart1] { mutate { add_field => { "ccPart1" => "" } } }
  mutate {
    replace => ["message", "%{ccPart1}XXXXXXXXXXXXXXXX%{ccPart2}"]
    remove_field => ["ccPart1", "ccPart2", "ccNumber"]
  }
}

```

It seems like there should be a more efficient way of doing this (besides creating a custom plugin). We're still on Logstash 1.4.2.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 6, 2016, 10:23am UTC](https://discuss.elastic.co/t/code-review-masking-credit-card-numbers/46507/2 "2016-04-06T10:23:58Z")

</div>

Wouldn't the gsub option of a mutate filter work?

---

<div class="post-metadata">

**Author:** ![Alex\_6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_6/32/1330_2.png) [@Alex\_6](https://discuss.elastic.co/u/Alex_6)\
**Post date:** [April 6, 2016, 11:00am UTC](https://discuss.elastic.co/t/code-review-masking-credit-card-numbers/46507/3 "2016-04-06T11:00:54Z")

</div>

Ah, good point. Thanks!

---

<div class="post-metadata">

**Author:** ![Alex\_6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_6/32/1330_2.png) [@Alex\_6](https://discuss.elastic.co/u/Alex_6)\
**Post date:** [April 6, 2016, 11:15am UTC](https://discuss.elastic.co/t/code-review-masking-credit-card-numbers/46507/4 "2016-04-06T11:15:31Z")

</div>

Ah, there is one thing though. In the original code a tag was added when a credit card number was found. Using Mutate/gsub what's the best way to add that tag now?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 6, 2016, 11:42am UTC](https://discuss.elastic.co/t/code-review-masking-credit-card-numbers/46507/5 "2016-04-06T11:42:32Z")

</div>

Something like

```auto
if [message] =~ /XXXXXXXXXXXXXXXX/ {
  mutate {
    add_tag => ["ccNumber"]
  }
}

```

maybe?

---

<div class="post-metadata">

**Author:** ![Alex\_6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_6/32/1330_2.png) [@Alex\_6](https://discuss.elastic.co/u/Alex_6)\
**Post date:** [April 6, 2016, 12:44pm UTC](https://discuss.elastic.co/t/code-review-masking-credit-card-numbers/46507/6 "2016-04-06T12:44:57Z")

</div>

What's the difference between `=~` and `in` as operators? I think `=~` can have regex but in this simple case are these the same?

```
if [message] =~ /XXXXXXXXXXXXXXXX/ {...}

```

vs.

```
if "XXXXXXXXXXXXXXXX" in [message] {...}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 6, 2016, 12:47pm UTC](https://discuss.elastic.co/t/code-review-masking-credit-card-numbers/46507/7 "2016-04-06T12:47:27Z")

</div>

Oh, right. Yeah, prefer the `in` operator in this case. It's a simple substring search that's faster than a regexp (but obviously not as expressive).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:03am UTC](https://discuss.elastic.co/t/code-review-masking-credit-card-numbers/46507/8 "2017-07-06T05:03:30Z")

</div>