# Generic solution for masking PII data in JSON payload

**URL:** <https://discuss.elastic.co/t/generic-solution-for-masking-pii-data-in-json-payload/303464>\
**Category:** Logstash\
**Created:** [April 28, 2022, 6:35am UTC](https://discuss.elastic.co/t/generic-solution-for-masking-pii-data-in-json-payload/303464 "2022-04-28T06:35:38Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hammad\_Ali](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hammad_ali/32/104975_2.png) [@Hammad\_Ali](https://discuss.elastic.co/u/Hammad_Ali)\
**Post date:** [April 28, 2022, 6:35am UTC](https://discuss.elastic.co/t/generic-solution-for-masking-pii-data-in-json-payload/303464/1 "2022-04-28T06:35:38Z")

</div>

Hello!

Is there any generic solution to mask PII data in JSON payload, I know about mutate gsub but that doesn't seem like a generic solution. I am looking for something that filters out all of the fields and masks any PII data with \*\*\*\*\*\*\*\*, etc if found.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 28, 2022, 4:35pm UTC](https://discuss.elastic.co/t/generic-solution-for-masking-pii-data-in-json-payload/303464/2 "2022-04-28T16:35:55Z")

</div>

What pattern does the PII match?

---

<div class="post-metadata">

**Author:** ![Hammad\_Ali](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hammad_ali/32/104975_2.png) [@Hammad\_Ali](https://discuss.elastic.co/u/Hammad_Ali)\
**Post date:** [April 29, 2022, 5:26am UTC](https://discuss.elastic.co/t/generic-solution-for-masking-pii-data-in-json-payload/303464/3 "2022-04-29T05:26:05Z")

</div>

Below is the sample code:

```auto
{
    "name" : "Gerry Kovan",
    "propertyAddress": "99-31 64th Avenue, Rego Park, NY, 11581",
    "creditCard": "4111111111111111",
    "creditCardExpiry": "05/26",
    "socialSecurityNumber": "123-45-6789",
    "principal": "100000",
    "interestRate": "5.0",
    "term": "30",
    "type": "fixed"
}

```

 ![1*jbLUkEvGVLt7wxxnFiRZfQ](https://us1.discourse-cdn.com/elastic/original/3X/3/2/32262a8e41a249838d6411b77016ca287e57149a.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 29, 2022, 5:26pm UTC](https://discuss.elastic.co/t/generic-solution-for-masking-pii-data-in-json-payload/303464/4 "2022-04-29T17:26:54Z")

</div>

You need to define the criteria for deciding what in that event is PII, and how you want to mask it.

Do you want anonymization or [pseudonymization](https://www.elastic.co/blog/gdpr-personal-data-pseudonymization-part-1)?

---

<div class="post-metadata">

**Author:** ![Hammad\_Ali](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hammad_ali/32/104975_2.png) [@Hammad\_Ali](https://discuss.elastic.co/u/Hammad_Ali)\
**Post date:** [May 16, 2022, 6:30am UTC](https://discuss.elastic.co/t/generic-solution-for-masking-pii-data-in-json-payload/303464/5 "2022-05-16T06:30:49Z")

</div>

If I receive a log as below, in the textPayload field I may or not receive PII data. I am looking for something that will filter every log for this field and mask PII data if found. I am looking for pseudonymization. Below are sample fields. I have received JSON data in textpayload i.e. title and desc. I want to mask the values of these fields if any of these match any PII data and that can be Name, Phone number, Email, etc. Any help is appreciated.

```auto
{
insertId: "sadjlkajsldjlsajdlsadsa"
labels: {3}
logName: "projects/projectName/logs/std"
receiveTimestamp: "2022-05-16T06:25:58.768249830Z"
resource: {2}
severity: "INFO"
textPayload: "2022-05-16 06:25:57,518 INFO {"title": "Fact", "desc": "Do something"}"
timestamp: "2022-05-16T06:25:57.519218768Z

```

---

<div class="post-metadata">

**Author:** ![Hammad\_Ali](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hammad_ali/32/104975_2.png) [@Hammad\_Ali](https://discuss.elastic.co/u/Hammad_Ali)\
**Post date:** [May 16, 2022, 8:05am UTC](https://discuss.elastic.co/t/generic-solution-for-masking-pii-data-in-json-payload/303464/6 "2022-05-16T08:05:55Z")

</div>

My bad, I am looking for anonymization.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 13, 2022, 8:06am UTC](https://discuss.elastic.co/t/generic-solution-for-masking-pii-data-in-json-payload/303464/7 "2022-06-13T08:06:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.