# Remove or subst for passwords in commandline logging?

**URL:** <https://discuss.elastic.co/t/remove-or-subst-for-passwords-in-commandline-logging/111126>\
**Category:** Logstash\
**Created:** [December 11, 2017, 3:11pm UTC](https://discuss.elastic.co/t/remove-or-subst-for-passwords-in-commandline-logging/111126 "2017-12-11T15:11:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\
**Post date:** [December 11, 2017, 3:11pm UTC](https://discuss.elastic.co/t/remove-or-subst-for-passwords-in-commandline-logging/111126/1 "2017-12-11T15:11:40Z")

</div>

Logging windows command line events; cmd and powershell. And while it's policy that no one should be entering passwords directly on the command line... well, you know.

Curious if anyone has come up with a clever way to filter/substitute for when users insist on entering passwords on the command line?

Example - something along these lines...

filter {  
mutate {  
gsub =\> [  
# replace all passwords with ######  
"[event\_data][CommandLine]", "regex matching password", "########",  
]  
}  
}

Maybe some regex to look for the required password complexity? I'd be surprised is someone hasn't written this already.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 8, 2018, 3:12pm UTC](https://discuss.elastic.co/t/remove-or-subst-for-passwords-in-commandline-logging/111126/2 "2018-01-08T15:12:04Z")

</div>

Closed on January 8, 2018, 3:12pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.