Which event processing pipeline contains the regex replacement processor that would be called upon to run event masking routines on events as they are ingested?
The parsing pipeline contains the regex replacement processor that would be called upon to run event masking routines on events as they are ingested. Event masking is a process of replacing sensitive data in events with a placeholder value, such as “XXXXX”. This is done by using the SEDCMD attribute in props.conf, which specifies a regular expression to apply to the raw data of an event. The regex replacement processor is responsible for executing the SEDCMD attribute on the events before they are indexed. References:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit