Mask Rule regular expressions

Comments

2 comments

  • Avatar
    Shobhit Garg

    Hi Nathan,

    Assuming you want to mask the SQL query then your regex is correct, I tested it.

    jdbc\.sqltiming\.373\s\[[a-z0-9]{16}\s[a-z0-9]{16}\]\s-\s*-\s*([^{]*)

    The masked data ingested in Sumologic is like below, here I masked the matching string with "testmm"

    jdbc.sqltiming.373 [ab8c71b34beb1443 748e59b77dd6190e] - - testmm{executed in 351 msec}

    Regards

    1
    Comment actions Permalink
  • Avatar
    Nathan Norman

    Thank you Shobhit Garg for your response. I was able to get this working.

    It turns out I had a syntax problem with a different mask rule which was preventing the new mask rule from being applied. It can be very tricky to spot the problems in the logs and when a configuration fails it seems to default to the last successful configuration, so it can be hard to notice.

    0
    Comment actions Permalink

Please sign in to leave a comment.