# Filtering all Fields/Events
**URL:** https://discuss.elastic.co/t/filtering-all-fields-events/254088
**Category:** Logstash
**Created:** [November 3, 2020, 1:31am UTC](https://discuss.elastic.co/t/filtering-all-fields-events/254088 "2020-11-03T01:31:40Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@faridNR](https://discuss.elastic.co/u/faridNR)
#### Post date: [November 3, 2020, 1:31am UTC](https://discuss.elastic.co/t/filtering-all-fields-events/254088/1 "2020-11-03T01:31:40Z")
Hello
Having a centralized log-stream using Logstash with more than hundreds of fields/events types.
I'm trying to apply filter to all events/fields and replacing a regex in this case email address. (removing PII)
what would be the best solution to apply filters to all fields/events and replacing a regex, without the need to identify the field names ?
Currently we are trying the following , however this does not work with json/xml with multiple nested elements, objects, array..
//filter {
//ruby {
// code =\> '
// event.to\_hash.each { |k, v|
// if v.is\_a?(String) and /@/ === v
// j = v.gsub!(/\b[A-Z0-9.\_%a-z]+@(?:[A-Z0-9a-z]+.)[A-Za-z]{2,5}/, "-")
// event.set(k, j)
// end
// }
// '
//}
//}
Thanks again
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 3, 2020, 2:21am UTC](https://discuss.elastic.co/t/filtering-all-fields-events/254088/2 "2020-11-03T02:21:55Z")
If you need to iterate over all the fields in an event, including the contents of hashes and arrays, then [this](https://discuss.elastic.co/t/to-exclude-around-350-fields-in-json-in-logstash/239019/6) may give you some ideas.
You probably do not need to do it as a ruby script, I expect it could be rewriten it as a ruby filter that uses the code option rather than the path option to get the code from a file.
Writing a regexp to match any email address that is "valid" is a really tough problem. There are valid domains that contain characters from non-English scripts such as Chinese or Cyrillic. Of course a lot of email programs will not handle such addresses even though they follow the "rules". So exotic email addresses may be "valid" but unusable.
For PII masking I would lean to being inclusive and masking things that may not be emails. [This](https://www.regular-expressions.info/email.html) page discusses some of the options for being more or less inclusive.
Personally I would lean towards using a POSIX class like [[:alnum:]] instead of [A-Za-z0-9]
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 1, 2020, 2:21am UTC](https://discuss.elastic.co/t/filtering-all-fields-events/254088/3 "2020-12-01T02:21:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.