|
1503 | 1503 | "$ref": "#/$defs/PipelineProcessor", |
1504 | 1504 | "description": "Executes another pipeline." |
1505 | 1505 | }, |
| 1506 | + "redact": { |
| 1507 | + "$ref": "#/$defs/RedactProcessor", |
| 1508 | + "description": "The Redact processor uses the Grok rules engine to obscure text in the input document matching the given Grok patterns. The processor can be used to obscure Personal Identifying Information (PII) by configuring it to detect known patterns such as email or IP addresses. Text that matches a Grok pattern is replaced with a configurable string such as `\u003cEMAIL\u003e` where an email address is matched or simply replace all matches with the text `\u003cREDACTED\u003e` if preferred." |
| 1509 | + }, |
1506 | 1510 | "remove": { |
1507 | 1511 | "$ref": "#/$defs/RemoveProcessor", |
1508 | 1512 | "description": "Removes existing fields. If one field doesn’t exist, an exception will be thrown." |
|
1559 | 1563 | "additionalProperties": false, |
1560 | 1564 | "type": "object" |
1561 | 1565 | }, |
| 1566 | + "RedactProcessor": { |
| 1567 | + "properties": { |
| 1568 | + "description": { |
| 1569 | + "type": "string", |
| 1570 | + "description": "Description of the processor. Useful for describing the purpose of the processor or its configuration." |
| 1571 | + }, |
| 1572 | + "if": { |
| 1573 | + "type": "string", |
| 1574 | + "description": "Conditionally execute the processor." |
| 1575 | + }, |
| 1576 | + "ignore_failure": { |
| 1577 | + "type": "boolean", |
| 1578 | + "description": "Ignore failures for the processor." |
| 1579 | + }, |
| 1580 | + "on_failure": { |
| 1581 | + "items": { |
| 1582 | + "$ref": "#/$defs/ProcessorContainer" |
| 1583 | + }, |
| 1584 | + "type": "array", |
| 1585 | + "description": "Handle failures for the processor." |
| 1586 | + }, |
| 1587 | + "tag": { |
| 1588 | + "type": "string", |
| 1589 | + "description": "Identifier for the processor. Useful for debugging and metrics." |
| 1590 | + }, |
| 1591 | + "field": { |
| 1592 | + "type": "string", |
| 1593 | + "description": "The field to be redacted. Required." |
| 1594 | + }, |
| 1595 | + "patterns": { |
| 1596 | + "items": { |
| 1597 | + "type": "string" |
| 1598 | + }, |
| 1599 | + "type": "array", |
| 1600 | + "description": "A list of grok expressions to match and redact named captures with. Required." |
| 1601 | + }, |
| 1602 | + "pattern_definitions": { |
| 1603 | + "additionalProperties": { |
| 1604 | + "type": "string" |
| 1605 | + }, |
| 1606 | + "type": "object" |
| 1607 | + }, |
| 1608 | + "prefix": { |
| 1609 | + "type": "string", |
| 1610 | + "description": "Start a redacted section with this token." |
| 1611 | + }, |
| 1612 | + "suffix": { |
| 1613 | + "type": "string", |
| 1614 | + "description": "End a redacted section with this token." |
| 1615 | + }, |
| 1616 | + "ignore_missing": { |
| 1617 | + "type": "boolean", |
| 1618 | + "description": "If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document." |
| 1619 | + }, |
| 1620 | + "skip_if_unlicensed": { |
| 1621 | + "type": "boolean", |
| 1622 | + "description": "If `true` and the current license does not support running redact processors, then the processor quietly exits without modifying the document." |
| 1623 | + } |
| 1624 | + }, |
| 1625 | + "additionalProperties": false, |
| 1626 | + "type": "object", |
| 1627 | + "required": [ |
| 1628 | + "field", |
| 1629 | + "patterns" |
| 1630 | + ] |
| 1631 | + }, |
1562 | 1632 | "RemoveProcessor": { |
1563 | 1633 | "properties": { |
1564 | 1634 | "description": { |
|
0 commit comments