Generic solution for masking PII data in JSON payload

[Hammad_Ali]

Hello!

Is there any generic solution to mask PII data in JSON payload, I know about mutate gsub but that doesn't seem like a generic solution. I am looking for something that filters out all of the fields and masks any PII data with ********, etc if found.

[Badger]

What pattern does the PII match?

[Hammad_Ali]

Below is the sample code:

{
    "name" : "Gerry Kovan",
    "propertyAddress": "99-31 64th Avenue, Rego Park, NY, 11581",
    "creditCard": "4111111111111111",
    "creditCardExpiry": "05/26",
    "socialSecurityNumber": "123-45-6789",
    "principal": "100000",
    "interestRate": "5.0",
    "term": "30",
    "type": "fixed"
}

[Badger]

You need to define the criteria for deciding what in that event is PII, and how you want to mask it.

Do you want anonymization or pseudonymization?

[Hammad_Ali]

If I receive a log as below, in the textPayload field I may or not receive PII data. I am looking for something that will filter every log for this field and mask PII data if found. I am looking for pseudonymization. Below are sample fields. I have received JSON data in textpayload i.e. title and desc. I want to mask the values of these fields if any of these match any PII data and that can be Name, Phone number, Email, etc. Any help is appreciated.

{
insertId: "sadjlkajsldjlsajdlsadsa"
labels: {3}
logName: "projects/projectName/logs/std"
receiveTimestamp: "2022-05-16T06:25:58.768249830Z"
resource: {2}
severity: "INFO"
textPayload: "2022-05-16 06:25:57,518 INFO     {"title": "Fact", "desc": "Do something"}"
timestamp: "2022-05-16T06:25:57.519218768Z

[Hammad_Ali]

My bad, I am looking for anonymization.