Mask PII data in ALB logs

[bhushan-amit]

I am sending my AWS ALB logs data (dumped at s3) to Elasticsearch using vector. Unfortunately, the request_url parts have some PII data in them. I want to mask it using vector before sending it to elastic search. The PII can be summed up in regex pattern as below:
pii_regex_patterns = {
"email": r"([a-zA-Z0-9.-]+@[a-zA-Z0-9.-]+.[a-zA-Z0-9_-]+)",
"phone": r"(+\d{1,3}[- ]?)?\d{10}[\s , )]",
"pan": r"[A-Z]{5}[0-9]{4}[A-Z]{1}",
"aadhar": r"[0-9]{4}[ -]?[0-9]{4}[ -]?[0-9]{4}[" " , . )]",
}

Can I possibly do that? Currently my vector.toml file is simple with the following transform section:
[transforms.aws_alb_logs_transform]
type = "remap"
inputs = ["aws_alb_logs"]
drop_on_error = false
source = '''
. = parse_aws_alb_log!(string!(.message))
.request_url_parts = parse_url!(.request_url)
'''

how can I achieve it? Have trouble with existing syntax.

[bhushan-amit]

Scrubbed it by using regex and replace function.

[transforms.aws_alb_logs_transform]
type = "remap"
inputs = ["aws_alb_logs"]
drop_on_error = false
source = '''
. = parse_aws_alb_log!(replace(replace(string!(.message),
    r'([a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+\.[a-zA-Z0-9_-]+)', "SCRUBBED"),
    r'(d{1,3}[- ]?)?\d{10}&', "SCRUBBED&"))
.request_url_parts = parse_url!(.request_url)
'''

[jszwedko]

You might also find the redact function useful for this purpose.