Allow filter sensitive data from query logs about collector HOT 3 CLOSED

yes, exactly! Function arguments contain sensitive data

from collector.

@danbst You're in luck, we're actually about to release a PII filtering feature to solve this kind of scenario :)

To understand your use case - you only want to mask log lines that reference your decryption/encryption function, presumably because there is a key or sensitive data contained, correct?

from collector.

Hi @danbst!

I realized this was actually released but I haven't updated the issue. You can now filter sensitive log data using the filter_log_secret configuration parameter.

One recommended configuration would be the following:

filter_log_secret: credential, parsing_error, table_data, statement_parameter

This filters known parts of loglines that are credentials, as well as parsing errors, any output of table data and statement parameters.

If you don't use statement parameters but have your encryption keys directly in the query, it may be good to also add statement_text to the filter list.

Hope thats useful!

from collector.