Logstash Anonymize plugin

Elastic Stack Logstash
1

Hi,

I am new to ELK and working on an assignment to anonymize few fields. I could successfully perform this action however is there a way if Logstash/Elasticsearch has a table having Field Value -> Hash mapping in order to de-anonymize later.

For example, Field "ClientIP" with value "10.0.0.12" is SHA1 hashed to "31695db444b86551d6b210285607775629256ddf"

There is an other application which will work on the hashed data, but the desired result is to get to know which is the actual Field value behind this Hashed data.

I am using Logstash & ES 2.4.

Please throw some light on this !!

Regards

2

Hashes are (luckily) a one-way operation. If you want access to the raw data for other purposes, perhaps you should store two copies of each event (one anonymized and one original)? Or, if you like, the event with the original value could also contain the hash.

3

Thanks, Got it.