# Logstash Anonymize plugin

**URL:** https://discuss.elastic.co/t/logstash-anonymize-plugin/63132
**Category:** Logstash
**Created:** [October 16, 2016, 4:43pm UTC](https://discuss.elastic.co/t/logstash-anonymize-plugin/63132 "2016-10-16T16:43:23Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![krlplm](https://avatars.discourse-cdn.com/v4/letter/k/9fc29f/32.png) [@krlplm](https://discuss.elastic.co/u/krlplm)
#### Post date: [October 16, 2016, 4:43pm UTC](https://discuss.elastic.co/t/logstash-anonymize-plugin/63132/1 "2016-10-16T16:43:23Z")

</div>

Hi,

I am new to ELK and working on an assignment to anonymize few fields. I could successfully perform this action however is there a way if Logstash/Elasticsearch has a table having **Field Value -\> Hash** mapping in order to de-anonymize later.

For example, Field " **ClientIP**" with value " **10.0.0.12**" is SHA1 hashed to " **31695db444b86551d6b210285607775629256ddf**"

There is an other application which will work on the hashed data, but the desired result is to get to know which is the actual Field value behind this Hashed data.

I am using **Logstash & ES 2.4**.

Please throw some light on this !!

Regards

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 16, 2016, 5:18pm UTC](https://discuss.elastic.co/t/logstash-anonymize-plugin/63132/2 "2016-10-16T17:18:19Z")

</div>

Hashes are (luckily) a one-way operation. If you want access to the raw data for other purposes, perhaps you should store two copies of each event (one anonymized and one original)? Or, if you like, the event with the original value could also contain the hash.

---

<div class="post-metadata">

### Author: ![krlplm](https://avatars.discourse-cdn.com/v4/letter/k/9fc29f/32.png) [@krlplm](https://discuss.elastic.co/u/krlplm)
#### Post date: [October 17, 2016, 6:29am UTC](https://discuss.elastic.co/t/logstash-anonymize-plugin/63132/3 "2016-10-17T06:29:32Z")

</div>

Thanks, Got it.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:34am UTC](https://discuss.elastic.co/t/logstash-anonymize-plugin/63132/4 "2017-07-06T04:34:00Z")

</div>


