# Pseudonymisation in ELK-Stack

**URL:** <https://discuss.elastic.co/t/pseudonymisation-in-elk-stack/41789>\
**Category:** Elasticsearch\
**Created:** [February 15, 2016, 1:19pm UTC](https://discuss.elastic.co/t/pseudonymisation-in-elk-stack/41789 "2016-02-15T13:19:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![RickX](https://avatars.discourse-cdn.com/v4/letter/r/ad7895/32.png) [@RickX](https://discuss.elastic.co/u/RickX)\
**Post date:** [February 15, 2016, 1:19pm UTC](https://discuss.elastic.co/t/pseudonymisation-in-elk-stack/41789/1 "2016-02-15T13:19:04Z")

</div>

Hey,

i have a running elk enviroment(logstash elasticsearch and kibana). Its working fine so far. The problem is that i have to exchange some data(ip adress, hostname, mac adress, etc.) with pseudonyms befor the logs are displayed in kibana, its a privacy thing.  
Are there any approved solutions for automatic pseudonymizing data and a option to reidentifing the data in this case?

thanks and greetings  
RickX

---

<div class="post-metadata">

**Author:** ![Borut\_Svara](https://avatars.discourse-cdn.com/v4/letter/b/c5a1d2/32.png) [@Borut\_Svara](https://discuss.elastic.co/u/Borut_Svara)\
**Post date:** [February 15, 2016, 1:31pm UTC](https://discuss.elastic.co/t/pseudonymisation-in-elk-stack/41789/2 "2016-02-15T13:31:31Z")

</div>

If you have access to queries you can write a script that replace fields, overwriting same named fields and replacing few middle caracters with '\*'.

Hope it may help.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 15, 2016, 3:57pm UTC](https://discuss.elastic.co/t/pseudonymisation-in-elk-stack/41789/3 "2016-02-15T15:57:22Z")

</div>

You're best off doing that with Logstash during processing, there are a number of filters that can handle this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:16pm UTC](https://discuss.elastic.co/t/pseudonymisation-in-elk-stack/41789/4 "2017-07-05T23:16:23Z")

</div>


