# How to Mask or Hash a certain details on my SMTP Logs Message

**URL:** <https://discuss.elastic.co/t/how-to-mask-or-hash-a-certain-details-on-my-smtp-logs-message/125687>\
**Category:** Logstash\
**Created:** [March 27, 2018, 2:29am UTC](https://discuss.elastic.co/t/how-to-mask-or-hash-a-certain-details-on-my-smtp-logs-message/125687 "2018-03-27T02:29:43Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![khbaltazar](https://avatars.discourse-cdn.com/v4/letter/k/41988e/32.png) [@khbaltazar](https://discuss.elastic.co/u/khbaltazar)\
**Post date:** [March 27, 2018, 2:29am UTC](https://discuss.elastic.co/t/how-to-mask-or-hash-a-certain-details-on-my-smtp-logs-message/125687/1 "2018-03-27T02:29:43Z")

</div>

\_Hi Guys, Im sending a smtp logs to our MSSP using logstash but we are required to mask some details on our logs like sender and recipient email address and subject before forwarding it to our MSSP due to some privacy requirements .. Please see sample logs below.. Im not sure if this is possible... I'm newbie to logstash and I don't know where to start.. \_

**Are regular SMTP logs message:**

2018:03:27-10:04:10 XMmailServer1 smtpd[28584]: SCANNER[28584]: id="1000" severity="info" sys="SecureMail" sub="smtp" name="email passed" srcip="10.5.100.11" [from="sender.name@senderaddress.com](mailto:from=%22sender.name@senderaddress.com)" [to="recipient.name@receiveremail.com](mailto:to=%22recipient.name@receiveremail.com) " subject="Re:Subject of the email need to hash or mask " queueid="1f0dy6-0007R2-62" size="34876"

**Are required SMTP logs message output sample:**  
_You will notice that we required to mask after the 5th digit of the sender,recipient and subject._

2018:03:27-10:04:10 MXServer1 smtpd[28584]: SCANNER[28584]: id="1000" severity="info" sys="SecureMail" sub="smtp" name="email passed" srcip="10.5.100.11" from="sende####@senderaddress.com" to="recip####@receiveremail.com " subject="Re:Su#####" queueid="1f0dy6-0007R2-62" size="34876"

**Thank you in advance for the help..!!**

---

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [March 27, 2018, 2:46am UTC](https://discuss.elastic.co/t/how-to-mask-or-hash-a-certain-details-on-my-smtp-logs-message/125687/2 "2018-03-27T02:46:01Z")

</div>

You can use [regex with mutate's gsub function](https://www.elastic.co/guide/en/logstash/6.2/plugins-filters-mutate.html#plugins-filters-mutate-gsub) to do that, something like below might work...not sure how mutate handles regex flags....and I am a complete novice with regex so there might be a better way.

```
mutate {
  gsub => [
    "FieldName", "/.....@/g", "#####"
  ]
}
```

---

<div class="post-metadata">

**Author:** ![khbaltazar](https://avatars.discourse-cdn.com/v4/letter/k/41988e/32.png) [@khbaltazar](https://discuss.elastic.co/u/khbaltazar)\
**Post date:** [March 27, 2018, 3:53am UTC](https://discuss.elastic.co/t/how-to-mask-or-hash-a-certain-details-on-my-smtp-logs-message/125687/3 "2018-03-27T03:53:51Z")

</div>

Thanks I think that's the right plugin .. but the my problem now is I don't know how to format or convert the logs sample below.

like from this message fields example : -~ [from="sender.name@senderaddress.com](mailto:from=%22sender.name@senderaddress.com)"  
to this message example output : -~ from="sende#####@senderaddress.com"

Thanks !

---

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [March 27, 2018, 4:46am UTC](https://discuss.elastic.co/t/how-to-mask-or-hash-a-certain-details-on-my-smtp-logs-message/125687/4 "2018-03-27T04:46:40Z")

</div>

> [@khbaltazar](#):
>
> Thanks I think that's the right plugin .. but the my problem now is I don't know how to format or convert the logs sample below.
> 
> like from this message fields example : -~ [from="sender.name@senderaddress.com](mailto:from=%22sender.name@senderaddress.com)"  
> to this message example output : -~ from="sende#####@senderaddress.com"
> 
> Thanks !

I'm sorry, I don't understand what you mean.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 24, 2018, 4:47am UTC](https://discuss.elastic.co/t/how-to-mask-or-hash-a-certain-details-on-my-smtp-logs-message/125687/5 "2018-04-24T04:47:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.