Skip to content

Commit 96b9bc7

Browse files
updated sensitive-data-redaction.md (#203)
1 parent 095b584 commit 96b9bc7

File tree

2 files changed

+25
-18
lines changed

2 files changed

+25
-18
lines changed

docs/user-guide/management/.pages

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,4 @@ nav:
99
- Cipher Keys: cipher-keys.md
1010
- Nodes in OpenObserve: nodes.md
1111
- SSO Domain Restrictions: sso-domain-restrictions.md
12-
- Sensitive Data Redaction: regex-patterns.md
12+
- Sensitive Data Redaction: sensitive-data-redaction.md

docs/user-guide/management/regex-patterns.md renamed to docs/user-guide/management/sensitive-data-redaction.md

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ The **Sensitive Data Redaction** feature helps prevent accidental exposure of se
5353
**To create a regex pattern:**
5454

5555
??? "Step 1: Discover sensitive data"
56+
### Step 1: Discover sensitive data
5657
Identify which fields may contain sensitive data.
5758

5859
1. From the left-hand menu, select **Logs**.
@@ -79,6 +80,7 @@ The **Sensitive Data Redaction** feature helps prevent accidental exposure of se
7980
}
8081
```
8182
??? "Step 2: Create and test regex patterns"
83+
### Step 2: Create and test regex patterns
8284
To create regex patterns, naviagte to **Management** > **Sensitive Data Redaction** > **Create Pattern**.
8385

8486
![Create regex](../../images/create-regex-pattern.png)
@@ -126,13 +128,15 @@ Once your patterns are created and tested, you can apply them to specific fields
126128
**To apply a pattern to a field:**
127129

128130
??? "Step 1: Go to the stream field"
131+
### Step 1: Go to the stream field
129132
1. From the left-hand menu, go to **Streams**.
130133
2. Locate the stream where you want to apply regex patterns and select **Stream Details** from the **Actions** column.
131134
3. In the **Stream Settings** tab, locate the field that contains sensitive data.
132135

133136
![Field with sesitive data](../../images/stream-settings-sensitive-fields.png)
134137

135138
??? "Step 2: Add pattern"
139+
### Step 2: Add pattern
136140
1. Select **Add Pattern** for the target field. This opens the pattern panel, where you can view already applied patterns and add new ones.
137141
![Add regex pattern](../../images/stream-settings-add-regex.png)
138142
2. From the **All Patterns** section, select a pattern you want to apply.
@@ -141,11 +145,11 @@ Once your patterns are created and tested, you can apply them to specific fields
141145
After selecting a pattern, a detail view appears.
142146
![Regex selection](../../images/regex-selection-view.png)
143147

144-
??? "Step 3: From the pattern details view, choose whether to Redact or Drop"
145-
148+
??? "Step 3: Choose whether to Redact or Drop"
149+
### Step 3: Choose whether to Redact or Drop
146150
![Regex pattern execution action- redact or drop](../../images/redact-or-drop-during-regex-pattern-execution.png)
147151

148-
When applying a regex pattern, you must choose one of the following actions:
152+
When applying a regex pattern, you must choose one of the following actions in the pattern details screen:
149153

150154
**Redact**:
151155

@@ -159,8 +163,9 @@ Once your patterns are created and tested, you can apply them to specific fields
159163

160164
Select the appropriate action between Redact and Drop.
161165

162-
??? "Step 4: From the pattern details view, choose when the action needs to be executed"
163-
You must decide whether the redaction or drop action will occur at ingestion time, query time, or both.
166+
??? "Step 4: Choose when the action needs to be executed"
167+
### Step 4: Choose when the action needs to be executed
168+
In the pattern details screen, select when the chosen action (redact or drop) should be executed, at ingestion time, query time, or both.
164169

165170
![Regex pattern execution time](../../images/regex-pattern-execution-time.png)
166171

@@ -180,6 +185,7 @@ Once your patterns are created and tested, you can apply them to specific fields
180185
**If neither ingestion time nor query time is selected, no redaction or drop is applied.**
181186

182187
??? "Step 5: Add pattern and update changes"
188+
### Step 5: Add pattern and update changes
183189

184190
1. To add the regex pattern to Applied Patterns, click **Add Pattern**.
185191
![Add regex pattern](../../images/add-regex-pattern.png)
@@ -196,6 +202,7 @@ Once your patterns are created and tested, you can apply them to specific fields
196202
All applied patterns will appear in the left-hand panel with check marks.
197203

198204
??? "Step 7: Save configuration"
205+
### Step 7: Save configuration
199206
When finished, click **Update Changes** to save the configuration. This activates the regex rules for the selected field.
200207

201208

@@ -210,7 +217,8 @@ The following regex patterns are applied to the `message` field of the `pii_test
210217
| IP Address | Drop | Ingestion | Removes IP addresses before storage |
211218
| Credit Card | Drop | Query | Excludes credit card numbers from results |
212219

213-
??? "Test 1: Redact at Ingestion Time"
220+
??? "Test 1: Redact at ingestion time"
221+
### Test 1: Redact at ingestion time
214222
**Pattern Configuration**:
215223
![redact-at-ingestion-time-test-config](../../images/redact-at-ingestion-time-test-config.png)
216224

@@ -235,7 +243,8 @@ The following regex patterns are applied to the `message` field of the `pii_test
235243
- This is the actual stored value on disk.
236244

237245

238-
??? "Test 2: Drop at Ingestion Time"
246+
??? "Test 2: Drop at ingestion time"
247+
### Test 2: Drop at ingestion time
239248
**Pattern Configuration**:
240249
![drop-at-query-time-test-config](../../images/drop-at-ingestion-time-test-config.png)
241250

@@ -259,7 +268,8 @@ The following regex patterns are applied to the `message` field of the `pii_test
259268
- Other fields remain intact.
260269
- This demonstrates field-level drop at ingestion.
261270

262-
??? "Test 3: Redact at Query Time"
271+
??? "Test 3: Redact at query time"
272+
### Test 3: Redact at query time
263273
**Pattern Configuration**:
264274
![redact-at-query-test-config](../../images/redact-at-query-test-config.png)
265275

@@ -285,7 +295,8 @@ The following regex patterns are applied to the `message` field of the `pii_test
285295
- Useful for compliance while maintaining data for authorized access.
286296

287297

288-
??? "Test 4: Drop at Query Time"
298+
??? "Test 4: Drop at query time"
299+
### Test 4: Drop at query time
289300
**Pattern Configuration**:
290301
![Drop at Query Time- Test Config](../../images/drop-at-query-time-test-config.png)
291302

@@ -318,14 +329,10 @@ The following regex patterns are applied to the `message` field of the `pii_test
318329
- **Performance**: Complex patterns may impact ingestion speed, but overall performance remains faster than VRL-based redaction.
319330

320331
## Troubleshooting
332+
| **Issue** | **Cause** | **Solution** |
333+
| -------------------------------------------------------- | ------------------------------------- | ----------------------------------------------------------------------------------------- |
334+
| The Add Pattern option is not visible in Stream Details. | The field is not of UTF8 type. | Check the field type in the Stream Details view. Only UTF8 fields support regex patterns. |
335+
| Pattern does not apply. | Configuration changes were not saved. | Ensure that you selected **Update Changes** after applying the pattern. |
321336

322-
**Issue**: The Add Pattern option is not visible in Stream Details. <br>
323-
**Cause**: The field is not of UTF8 type. <br>
324-
**Solution**: Check the field type in the Stream Details view. Only UTF8 fields support regex patterns. <br>
325-
326-
<br>
327-
**Issue**: Pattern does not apply. <br>
328-
**Cause**: Configuration changes were not saved.<br>
329-
**Solution**: Ensure that you selected **Update Changes** after applying the pattern.<br>
330337

331338

0 commit comments

Comments
 (0)