# Hide\_keywords does not seem to be working

**URL:** <https://discuss.elastic.co/t/hide-keywords-does-not-seem-to-be-working/132595>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [May 20, 2018, 2:29pm UTC](https://discuss.elastic.co/t/hide-keywords-does-not-seem-to-be-working/132595 "2018-05-20T14:29:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Wanderer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wanderer/32/55140_2.png) [@Wanderer](https://discuss.elastic.co/u/Wanderer)\
**Post date:** [May 20, 2018, 2:29pm UTC](https://discuss.elastic.co/t/hide-keywords-does-not-seem-to-be-working/132595/1 "2018-05-20T14:29:48Z")

</div>

Packetbeat 6.2.4

packetbeat.yml http settings:

- type: http  
ports: [80, 8080, 8000, 5000, 8002]  
hide\_keywords: ["pass", "password", "passwd", "pwd"]  
send\_headers: ["from", "host", "code", "link", "server", "x-pingback", "phrase"]  
#send\_all\_headers: true  
send\_request: true  
real\_ip\_header: "X-Forwarded-For"

sample request field:  
GET /someurl  
Host: [somesite.com](http://somesite.com)  
Connection: keep-alive  
Accept: application/json, text/javascript, _/_; q=0.01  
X-Requested-With: XMLHttpRequest  
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36  
DNT: 1  
Referer: [http://somesite](http://somesite)  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.9  
Cookie: username=dfgdfgdfgdfg; password=sdfgsdfgdfgdfgdfgdfg; PHPSESSID=dfsgdfgdfgdfgdfg

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [May 22, 2018, 6:58am UTC](https://discuss.elastic.co/t/hide-keywords-does-not-seem-to-be-working/132595/2 "2018-05-22T06:58:43Z")

</div>

`hide_keywords` will only hide keywords in the URL query string and those passed by POST, so it doesn't work on cookies. (See [the documentation](https://www.elastic.co/guide/en/beats/packetbeat/6.0/packetbeat-http-options.html#_literal_hide_keywords_literal) for a more thorough explanation).

Also, the contents of the `request` or `response` fields (created when `send_request` or `send_response` are set) are never censored.

But I think it's not a bad idea to have `hide_keywords` apply to cookies (or a similar option i.e. `hide_cookies`) and also to censor the raw `request` and `response`. Feel free to open a [feature request](https://github.com/elastic/beats/issues/new).

---

<div class="post-metadata">

**Author:** ![Wanderer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wanderer/32/55140_2.png) [@Wanderer](https://discuss.elastic.co/u/Wanderer)\
**Post date:** [May 22, 2018, 11:37am UTC](https://discuss.elastic.co/t/hide-keywords-does-not-seem-to-be-working/132595/3 "2018-05-22T11:37:58Z")

</div>

Thank you for the reply. The ability to have a blanket removal of sensitive data i think is imperative especially now with GDPR...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 19, 2018, 11:37am UTC](https://discuss.elastic.co/t/hide-keywords-does-not-seem-to-be-working/132595/4 "2018-06-19T11:37:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.