A centralised log collection path provides visibility, but it can simultaneously become a data-leak surface. A masking layer placed between source and destination using Vector and VRL reduces that risk in a quick and measured way.
Why mask at the pipeline layer?
Records that have already been indexed or shared with other teams are hard to clean up after the fact. Fixing the application side is the right move long-term, but in the short term placing a protective layer on the centralised pipeline meaningfully reduces risk.
Sample VRL transform
[transforms.mask_sensitive]
type = "remap"
inputs = ["app_logs"]
source = '''
if exists(.email) {
.email = replace(string!(.email), r'(^.).*(@.*$)', "$1***$2")
}
if exists(.token) {
.token = "masked-token"
}
'''Conclusion
A sensitive-data masking pipeline for logs with Vector and VRL gives you a quick and effective protection layer on the central log path. The best log pipeline is not the one that gathers the most data, but the one that carries the right data through safely.