Skip to main content
The redact transform removes or pseudonymizes personally identifiable information before data leaves your pipeline. It ships with 11 built-in patterns for common PII types and supports custom regex for anything else.

​
Quick start

Redact all emails and IP addresses: 
[[routing.rules.transformers]]
type = "redact"
patterns = ["email", "ipv4"]
scan_all = true
This replaces matches with [REDACTED]. To keep data linkable across events, use hashing instead: 
[[routing.rules.transformers]]
type = "redact"
strategy = "hash"
hash_key = "your-secret-key"
patterns = ["email", "ipv4"]
scan_all = true
Hashing produces deterministic pseudonyms like usr_7kJ9mNpQ3xYz — the same input always produces the same hash, so you can still correlate events without storing raw PII.

​
Built-in patterns

PatternDetectsHash prefix
emailEmail addressesusr_
phonePhone numbers (international formats)phn_
credit_cardCredit card numbers (13-19 digits)cc_
ssn_usUS Social Security Numbersssn_
cpr_dkDanish CPR numberscpr_
nino_ukUK National Insurance Numbersnin_
bsn_nlDutch BSN numbersbsn_
ipv4IPv4 addressesip4_
ipv6IPv6 addressesip6_
passportPassport numberspas_
ibanInternational Bank Account Numbersiba_

​
Strategies

StrategyOutputUse when…
redact (default)[REDACTED]You want PII completely removed
hashusr_7kJ9mNpQ3xYzYou need to correlate events without raw PII
Hashing uses HMAC-SHA256 with your hash_key. Different keys produce different hashes, so each workspace can be isolated.

​
Targeted fields

Instead of scanning all strings (scan_all = true), you can target specific JSON paths for better performance: 
[[routing.rules.transformers]]
type = "redact"
strategy = "hash"
hash_key = "your-secret-key"

[[routing.rules.transformers.fields]]
path = "user.email"
pattern = "email"

[[routing.rules.transformers.fields]]
path = "client_ip"
pattern = "ipv4"
strategy = "redact"
Each targeted field can override the default strategy. In this example, emails are hashed but IP addresses are fully redacted.

​
Custom patterns

Define your own regex patterns for domain-specific PII: 
[[routing.rules.transformers]]
type = "redact"
strategy = "hash"
hash_key = "your-secret-key"
scan_all = true

[[routing.rules.transformers.custom_patterns]]
name = "employee_id"
regex = "EMP-\\d{6}"
prefix = "emp_"

[[routing.rules.transformers.custom_patterns]]
name = "order_id"
regex = "ORD-[0-9A-Z]{8}"
prefix = "ord_"
Custom patterns work with both strategies and are checked alongside built-in patterns.

​
Reference

FieldDefaultDescription
type—"redact"
strategy"redact""redact" or "hash"
hash_key—Secret key for HMAC-SHA256 (required if strategy = "hash")
patterns[]Built-in pattern names to detect
fields[]Targeted field objects: {path, pattern, strategy?}
custom_patterns[]Custom regex objects: {name, regex, prefix}
scan_allfalseScan all string values (slower but comprehensive)
enabledtrueSet to false to disable
At least one of patterns, fields, or custom_patterns is required.