Type to search.

Redact processor

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack 9.4+

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Generally available since 9.4

    This functionality is generally available and ready for production usage.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

The Redact processor redacts sensitive data in a string field by matching Grok patterns and replacing the matched content with a placeholder.

To redact sensitive information:

  1. Select Create → Create processor.
  2. Select Redact from the Processor menu.
  3. Set the Source Field to the field containing text you want to redact.
  4. Set the Patterns to one or more Grok patterns that match sensitive data (for example, IP addresses or email addresses).

This functionality uses the Elasticsearch Redact processor internally, but you configure it in Streamlang. Streamlang doesn't always have 1:1 parity with the ingest processor options and behavior. Refer to Processor limitations and inconsistencies.

In YAML mode, configure the redact processor using the following parameters. For the complete Streamlang syntax, refer to the Streamlang reference.

Parameter Type Required Description
from string Yes Source field to redact.
patterns string[] Yes Grok patterns that match sensitive data.
pattern_definitions object No Custom pattern definitions.
prefix string No Prefix for the redacted placeholder. Defaults to <.
suffix string No Suffix for the redacted placeholder. Defaults to >.
ignore_missing boolean No When true, skip this processor if the source field is missing. Defaults to true.
YAML 
- action: redact
  from: body.message
  patterns:
    - "%{IP:ip_address}"