Masking protects sensitive data in your Kubernetes log pipeline by applying regex-based transformations to log records before they leave your cluster. Use it to hide, hash, partially redact, or completely remove sensitive information such as personally identifiable information (PII), credentials, API tokens, and secrets.

Applies to: Pod logs collected by the Worker Agent

Prerequisites

• Log Management is enabled for your client.
• Pod log collection is enabled, see Configuring Pod Log Collection.
• Agent version 22.0.0 or later.

How masking works

Masking rules live in the masking array under pods in the opsramp-logs-user-config ConfigMap. Each rule defines:

• What to match - a regex pattern
• What to do with matches - replace, partially hide, hash, or delete the key entirely
• Where to apply it - everywhere, or scoped to a specific attribute

To add or edit masking rules:

kubectl edit configmap opsramp-logs-user-config -n <agent-namespace>

pods:
  enable: true
  masking:
    - attribute_type: "<scope>"
      attribute_key: "<key-name>"
      text: '<regex-pattern>'
      placeholder: '<replacement>'
      mode: "<masking-mode>"

Changes are detected automatically if the agent restarts the log collector within a few minutes to apply them.

Field reference

Masking modes

1. replace (default)

Replaces every regex match with the placeholder text. This is the default mode, if mode is omitted, replace is used.

masking:
  - text: '\d{3}-\d{2}-\d{4}'
    placeholder: '***-**-****'
    mode: replace

2. partial

Replaces only the first capture group in the regex, leaving surrounding text intact. Useful when you want to keep a label visible (like password=) but hide the value.

masking:
  - text: '\d{4}(-\d{4}-\d{4}-)\d{4}'
    placeholder: '-****-****-'
    mode: partial

Requirements:

• The regex must contain at least one capture group (...).
• Only the first capture group is replaced.
• If there’s no capture group, or no match, the value is left unchanged.

3. hash

Replaces each match with a truncated SHA-256 hash (16 hex characters). The same input always produces the same hash, allowing you to correlate log records containing the same sensitive value without exposing the original data. The placeholder field is ignored in this mode.

masking:
  - text: 'Bearer [A-Za-z0-9._\-]+'
    placeholder: ""
    mode: hash

4. redact_key

Removes the entire key-value pair from structured data when its value matches the regex, rather than just masking the value in place.

masking:
  - text: '.*'
    placeholder: ""
    mode: redact_key
    attribute_type: resource
    attribute_key: k8s.pod.ip

Scoping: controlling where a rule applies

By default, a masking rule applies to all resource attributes, record attributes, and the log body. Use attribute_type and attribute_key to limit the rule to a specific scope or attribute.

Important: When attribute_type is set to resource or record, the log body is never modified, even if attribute_key is left empty. To mask the body, leave attribute_type empty.

Examples

Example 1: Mask email addresses everywhere

Scope: attribute_type: "" + attribute_key: "" → applies to all resource attributes, all record attributes, and the body.

masking:
  - attribute_type: ""
    attribute_key: ""
    text: '[a-z0-9._%+\-]+@[a-z0-9.\-]+\.[a-z]{2,4}'
    placeholder: '[EMAIL REDACTED]'
    mode: replace

Example 2: Remove pod IP from resource attributes

Deletes the k8s.pod.ip key entirely from resource attributes.

masking:
  - attribute_type: resource
    attribute_key: k8s.pod.ip
    text: '.*'
    placeholder: ""
    mode: redact_key

Example 3: Partially mask passwords, keep the label visible

Applies everywhere. Only the captured password value is replaced; the password= label stays visible for debugging.

masking:
  - attribute_type: ""
    attribute_key: ""
    text: '(?i)password[=:\s]+["\x27]?(\S+)["\x27]?'
    placeholder: '***'
    mode: partial

Example 4: Hash Bearer tokens for correlation

Applies everywhere. The same token always produces the same hash, so you can trace which log records share a token without exposing the value itself.

masking:
  - attribute_type: ""
    attribute_key: ""
    text: 'Bearer [A-Za-z0-9._\-]+'
    placeholder: ""
    mode: hash

Example 5: Combining multiple rules

Rules run in order, and each applies independently to every log record. A value already modified by one rule can be modified again by a later rule.

masking:
  # Rule 1: Replace SSNs everywhere
  - attribute_type: ""
    attribute_key: ""
    text: '\d{3}-\d{2}-\d{4}'
    placeholder: '***-**-****'
    mode: replace
  # Rule 2: Hash API secrets everywhere
  - attribute_type: ""
    attribute_key: ""
    text: 'secret-[a-z0-9]+'
    placeholder: ""
    mode: hash
  # Rule 3: Remove pod IPs from resource attributes only
  - attribute_type: resource
    attribute_key: k8s.pod.ip
    text: '.*'
    placeholder: ""
    mode: redact_key

Full ConfigMap example

apiVersion: v1
kind: ConfigMap
metadata:
  name: opsramp-logs-user-config
data:
  logsConfig.yaml: |
    pods:
      enable: true
      namespaces:
        include:
        is_include_regex: false
        exclude:
        is_exclude_regex: false
      log_level: "Unspecified"
      masking:
        - attribute_type: ""
          attribute_key: ""
          text: '[a-z0-9._%+\-]+@[a-z0-9.\-]+\.[a-z]{2,4}'
          placeholder: '[REDACTED]'
          mode: replace
        - attribute_type: resource
          attribute_key: k8s.pod.ip
          text: '.*'
          placeholder: ""
          mode: redact_key    

Behavior

Troubleshooting

If you encounter kube events issues, see the Troubleshooting documentation.