# How do I encrypt multiple fields?

**URL:** <https://discuss.elastic.co/t/how-do-i-encrypt-multiple-fields/126153>\
**Category:** Logstash\
**Created:** [March 29, 2018, 7:50pm UTC](https://discuss.elastic.co/t/how-do-i-encrypt-multiple-fields/126153 "2018-03-29T19:50:50Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![wakame](https://avatars.discourse-cdn.com/v4/letter/w/d9b06d/32.png) [@wakame](https://discuss.elastic.co/u/wakame)\
**Post date:** [March 29, 2018, 7:50pm UTC](https://discuss.elastic.co/t/how-do-i-encrypt-multiple-fields/126153/1 "2018-03-29T19:50:50Z")

</div>

how do I encrypt multiple fields?

cipher{  
source =\> "field1"  
target =\> "field1"  
}  
cipher{  
source =\> "field2"  
target =\> "field2"  
}  
cipher{  
source =\> "field3"  
target =\> "field3"  
}

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [March 29, 2018, 9:29pm UTC](https://discuss.elastic.co/t/how-do-i-encrypt-multiple-fields/126153/2 "2018-03-29T21:29:24Z")

</div>

_Disclaimer: the cipher plugin was not authored by or audited by security professionals; as stated in the project license, you use it at your own risk._

The cipher plugin accepts a single _string_ field as input for either encryption or decryption, and outputs to a single field as a string; if you wish for a more structured payload and have a nested structure at key `foo`, you can use something like the json\_encode filter to create a string field that represents that structured data.

I prefer my field names to indicate to me what they hold, instead of overwriting, so I would do something like the following.

```auto
filter {
  # setup; placing a structured map in the event
  mutate {
    add_field => {
      "[foo][bar]" => "fubar"
      "[foo][baz]" => 17
    }
  }
  # `[foo]` is a map containing keys "bar" and "baz"

  json_encode {
    source => "[foo]"
    target => "[foo_json]"
    remove_field => "[foo]"
  }
  # `[foo_json]` is a string json representation of a map

  cipher {
    # ...
    source => "[foo_json]"
    target => "[foo_json_cipher]"
    remove_field => "[foo_json]"
  }
  # `[foo_json_cipher]` is a string representing the result of passing json through the cipher filter

}

```

---

<div class="post-metadata">

**Author:** ![wakame](https://avatars.discourse-cdn.com/v4/letter/w/d9b06d/32.png) [@wakame](https://discuss.elastic.co/u/wakame)\
**Post date:** [March 31, 2018, 4:02am UTC](https://discuss.elastic.co/t/how-do-i-encrypt-multiple-fields/126153/3 "2018-03-31T04:02:35Z")

</div>

This is what I'm trying to do. I can't seem to get anyone of them encrypted.

if [type] == "route" {  
cipher {  
algorithm =\> "AES-256-CBC-HMAC-SHA256"  
iv\_random\_length =\> 16 key =\> "xxxx"  
key\_size =\> 32 mode =\> "encrypt"  
source =\> "request\_http\_headers"  
target =\> "request\_http\_headers\_enc"  
base64 =\> true max\_cipher\_reuse =\> 1000  
}  
cipher {  
algorithm =\> "AES-256-CBC-HMAC-SHA256"  
iv\_random\_length =\> 16 key =\> "xxxxx"  
key\_size =\> 32 mode =\> "encrypt"  
source =\> "response\_body"  
target =\> "response\_body\_enc"  
base64 =\> true max\_cipher\_reuse =\> 1000  
}  
cipher {  
algorithm =\> "AES-256-CBC-HMAC-SHA256"  
iv\_random\_length =\> 16 key =\> "xxxxxx"  
key\_size =\> 32 mode =\> "encrypt"  
source =\> "request\_body"  
target =\> "request\_body\_enc"  
base64 =\> true max\_cipher\_reuse =\> 1000  
}  
cipher {  
algorithm =\> "AES-256-CBC-HMAC-SHA256"  
iv\_random\_length =\> 16 key =\> "xxxxxx"  
key\_size =\> 32 mode =\> "encrypt"  
source =\> "response\_http\_headers"  
target =\> "response\_http\_headers\_enc"  
base64 =\> true max\_cipher\_reuse =\> 1000  
}  
json {  
source =\> "message"  
remove\_field =\> ["message"]  
}  
mutate {  
remove\_field =\> ["request\_http\_headers"]  
}  
}

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [March 31, 2018, 6:12pm UTC](https://discuss.elastic.co/t/how-do-i-encrypt-multiple-fields/126153/4 "2018-03-31T18:12:27Z")

</div>

What is happening, and how us that different from what you expect?

- Is `AES-256-CBC-HMAC-SHA256` a supported algorithm, or supported way of referencing that algorithm on your system?
- do the logs reveal anything interesting?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 28, 2018, 6:12pm UTC](https://discuss.elastic.co/t/how-do-i-encrypt-multiple-fields/126153/5 "2018-04-28T18:12:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.