# How to mask the content which will be available in persistence queue file **URL:** \ **Category:** Logstash\ **Created:** [February 12, 2024, 1:55pm UTC](https://discuss.elastic.co/t/how-to-mask-the-content-which-will-be-available-in-persistence-queue-file/353075 "2024-02-12T13:55:02Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![siva0030](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/siva0030/32/130398_2.png) [@siva0030](https://discuss.elastic.co/u/siva0030)\ **Post date:** [February 12, 2024, 1:55pm UTC](https://discuss.elastic.co/t/how-to-mask-the-content-which-will-be-available-in-persistence-queue-file/353075/1 "2024-02-12T13:55:02Z")
Hello Team, We are using Logstash (8.11.3) in our monitoring to receive data from different source systems (via Filebeat, Metricbeat, and Winlogbeat). On the Logstash side, we are using a persistence queue. Since, Logstash persistent queues store events on disk, which is "at rest”. Recently, a security audit was conducted in our organization, and it was required to mask the content stored in the persistent queue files. As per the current setup, with root privilege user can read (cat page file) information from the persistent queue files. Is there any functionality or feature available on the Logstash that can help us mask the content which will be get stored in the persistent queue files? It would be great if I get any response! Thank You, Siva ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [February 12, 2024, 3:00pm UTC](https://discuss.elastic.co/t/how-to-mask-the-content-which-will-be-available-in-persistence-queue-file/353075/2 "2024-02-12T15:00:12Z")
> [@siva0030](#): > > Is there any functionality or feature available on the Logstash that can help us mask the content which will be get stored in the persistent queue files? There is not. ---
**Author:** ![siva0030](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/siva0030/32/130398_2.png) [@siva0030](https://discuss.elastic.co/u/siva0030)\ **Post date:** [February 12, 2024, 3:27pm UTC](https://discuss.elastic.co/t/how-to-mask-the-content-which-will-be-available-in-persistence-queue-file/353075/3 "2024-02-12T15:27:07Z")
@leandrojmp - thanks for your response! does any one have any other alternate ideas to achieve this ? I mean not with Logstash. Any other solutions to encrypt the persistent files at rest? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [February 12, 2024, 3:46pm UTC](https://discuss.elastic.co/t/how-to-mask-the-content-which-will-be-available-in-persistence-queue-file/353075/4 "2024-02-12T15:46:10Z")
> [@siva0030](#): > > Any other solutions to encrypt the persistent files at rest? I don't think this is possible, if you encrypt the files using an external tool, Logstash will not be able to write or read on the persistent queue. Any change made to the persistent queue files from external tools may lead to corruption of those files. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 12, 2024, 3:58pm UTC](https://discuss.elastic.co/t/how-to-mask-the-content-which-will-be-available-in-persistence-queue-file/353075/5 "2024-02-12T15:58:30Z")
> [@siva0030](#): > > with root privilege user can read (cat page file) information from the persistent queue files. If you need to protect against a privileged user reading the files then it's not something a tool like logstash can do. You need an OS designed from the ground up to protect against this. For example, some systems can specify which executables can access a file, what time of day or day of the week they can do it, and which users can run the executable. But that is all external to logstash. ---
**Author:** ![siva0030](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/siva0030/32/130398_2.png) [@siva0030](https://discuss.elastic.co/u/siva0030)\ **Post date:** [February 13, 2024, 8:16am UTC](https://discuss.elastic.co/t/how-to-mask-the-content-which-will-be-available-in-persistence-queue-file/353075/6 "2024-02-13T08:16:42Z")
Ok @leandrojmp - thanks for your explanation ---
**Author:** ![Sunile\_Manjee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunile_manjee/32/111461_2.png) [@Sunile\_Manjee](https://discuss.elastic.co/u/Sunile_Manjee)\ **Post date:** [February 14, 2024, 3:03pm UTC](https://discuss.elastic.co/t/how-to-mask-the-content-which-will-be-available-in-persistence-queue-file/353075/7 "2024-02-14T15:03:54Z")
I would seriously look at Spark for doing this: pyspark.pandas.DataFrame.mask ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 13, 2024, 3:03pm UTC](https://discuss.elastic.co/t/how-to-mask-the-content-which-will-be-available-in-persistence-queue-file/353075/8 "2024-03-13T15:03:59Z")
Closed on March 13, 2024, 3:03pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.