Redact Transform

The redact transform removes or pseudonymizes personally identifiable information before data leaves your pipeline. It ships with 11 built-in patterns for common PII types and supports custom regex for anything else.

Quick start

Redact all emails and IP addresses:

[[routing.rules.transformers]]
type = "redact"
patterns = ["email", "ipv4"]
scan_all = true

This replaces matches with [REDACTED]. To keep data linkable across events, use hashing instead:

[[routing.rules.transformers]]
type = "redact"
strategy = "hash"
hash_key = "your-secret-key"
patterns = ["email", "ipv4"]
scan_all = true

Hashing produces deterministic pseudonyms like usr_7kJ9mNpQ3xYz — the same input always produces the same hash, so you can still correlate events without storing raw PII.

Built-in patterns

Pattern	Detects	Hash prefix
`email`	Email addresses	`usr_`
`phone`	Phone numbers (international formats)	`phn_`
`credit_card`	Credit card numbers (13-19 digits)	`cc_`
`ssn_us`	US Social Security Numbers	`ssn_`
`cpr_dk`	Danish CPR numbers	`cpr_`
`nino_uk`	UK National Insurance Numbers	`nin_`
`bsn_nl`	Dutch BSN numbers	`bsn_`
`ipv4`	IPv4 addresses	`ip4_`
`ipv6`	IPv6 addresses	`ip6_`
`passport`	Passport numbers	`pas_`
`iban`	International Bank Account Numbers	`iba_`

Strategies

Strategy	Output	Use when…
`redact` (default)	`[REDACTED]`	You want PII completely removed
`hash`	`usr_7kJ9mNpQ3xYz`	You need to correlate events without raw PII

Hashing uses HMAC-SHA256 with your hash_key. Different keys produce different hashes, so each workspace can be isolated.

Targeted fields

Instead of scanning all strings (scan_all = true), you can target specific JSON paths for better performance:

[[routing.rules.transformers]]
type = "redact"
strategy = "hash"
hash_key = "your-secret-key"

[[routing.rules.transformers.fields]]
path = "user.email"
pattern = "email"

[[routing.rules.transformers.fields]]
path = "client_ip"
pattern = "ipv4"
strategy = "redact"

Each targeted field can override the default strategy. In this example, emails are hashed but IP addresses are fully redacted.

Custom patterns

Define your own regex patterns for domain-specific PII:

[[routing.rules.transformers]]
type = "redact"
strategy = "hash"
hash_key = "your-secret-key"
scan_all = true

[[routing.rules.transformers.custom_patterns]]
name = "employee_id"
regex = "EMP-\\d{6}"
prefix = "emp_"

[[routing.rules.transformers.custom_patterns]]
name = "order_id"
regex = "ORD-[0-9A-Z]{8}"
prefix = "ord_"

Custom patterns work with both strategies and are checked alongside built-in patterns.

Reference

Field	Default	Description
`type`	—	`"redact"`
`strategy`	`"redact"`	`"redact"` or `"hash"`
`hash_key`	—	Secret key for HMAC-SHA256 (required if `strategy = "hash"`)
`patterns`	`[]`	Built-in pattern names to detect
`fields`	`[]`	Targeted field objects: `{path, pattern, strategy?}`
`custom_patterns`	`[]`	Custom regex objects: `{name, regex, prefix}`
`scan_all`	`false`	Scan all string values (slower but comprehensive)
`enabled`	`true`	Set to `false` to disable

At least one of patterns, fields, or custom_patterns is required.

Getting Started

Tracking

Pipeline

Analytics

Installing

Redact Transform

Quick start

Built-in patterns

Strategies

Targeted fields

Custom patterns

Reference

​Quick start

​Built-in patterns

​Strategies

​Targeted fields

​Custom patterns

​Reference

Quick start

Built-in patterns

Strategies

Targeted fields

Custom patterns

Reference