Filter some personalId from accesslogs

I have some personalIDs in accesslogs that I want to encrypt or mutate in logstash filter. - - [12/Aug/2016:17:05:07 +0530] "GET /myService/v2.0/person/00123456/
in above logs, I want to check if some pesronalID pattern is there in the event. if YES, then I want to encrypt last 4-5 digits to * star or # hash.
How can I do that?


Use the mutate filter's gsub option.