# PII data in ingested into the ELK environment

**URL:** <https://discuss.elastic.co/t/pii-data-in-ingested-into-the-elk-environment/101051>\
**Category:** Logstash\
**Created:** [September 19, 2017, 4:20pm UTC](https://discuss.elastic.co/t/pii-data-in-ingested-into-the-elk-environment/101051 "2017-09-19T16:20:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kal](https://avatars.discourse-cdn.com/v4/letter/k/9de053/32.png) [@kal](https://discuss.elastic.co/u/kal)\
**Post date:** [September 19, 2017, 4:20pm UTC](https://discuss.elastic.co/t/pii-data-in-ingested-into-the-elk-environment/101051/1 "2017-09-19T16:20:54Z")

</div>

Hello, we are needing to figure out if there's any personally identifiable information stored in our ELK stack, I did see a bunch of articles on finding CC numbers within the environment, but unless I am mistaken, it seems rudimentary and cumbersome. Are there are any native or 3rd party tools that integrate to allow us to custom search for whatever PII information (or PCI etc.) might be stored in the environment?

Thanks in advance, please let me know if more information is needed.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 20, 2017, 12:50am UTC](https://discuss.elastic.co/t/pii-data-in-ingested-into-the-elk-environment/101051/2 "2017-09-20T00:50:38Z")

</div>

I haven't seen anything for this. Usually you'd do this during ingestion and either tag, mask or remove the data.

Also we’ve renamed ELK to the Elastic Stack, otherwise Beats feels left out 😉

---

<div class="post-metadata">

**Author:** ![kal](https://avatars.discourse-cdn.com/v4/letter/k/9de053/32.png) [@kal](https://discuss.elastic.co/u/kal)\
**Post date:** [September 20, 2017, 4:47pm UTC](https://discuss.elastic.co/t/pii-data-in-ingested-into-the-elk-environment/101051/3 "2017-09-20T16:47:50Z")

</div>

Thanks for your reply! This is not happening today, I was hoping there would be something that could RESTfully access data from Logstash and parse it for specific data.

And I would never want Beats to feel left out... Sorry!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 18, 2017, 4:48pm UTC](https://discuss.elastic.co/t/pii-data-in-ingested-into-the-elk-environment/101051/4 "2017-10-18T16:48:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.