1

I need to filter Log4j output to remove "sensitive" information like passwords from the log messages. The goal is to do something like this:

Replace:

05-Jan-2018 INFO [org.my.application] Username=Bob  Password=myWeakPassword

With:

05-Jan-2018 INFO [org.my.application] Username=Bob  Password=*********

This is fairly easy to do in Log4j V1, by extending the PatternLayout class: 

public class CustomPatternLayout extends org.apache.log4j.PatternLayout {
    @Override
    public String format(LoggingEvent event) {
        String temp = super.format(event);
        return doFilteringStuff(temp);
    }
}

However, in Log4j V2 the PatternLayout class was made "final" and the whole architecture was changed. There no longer seems to be a simple way to intercept/override the calls to the PatternLayout object. I looked at the Apache documentation but there's not much information.

I checked this question and this question but neither one has much help to offer.

I realize this is a very "general" question but does anyone know a straightforward way to do this in Log4j V2, or have any advice on this?

user1071914
  • 3,295
  • 11
  • 50
  • 76

1 Answers1

2

I think what you’re looking for is the RewriteAppender. From the manual:

The RewriteAppender allows the LogEvent to manipulated before it is processed by another Appender. This can be used to mask sensitive information such as passwords or to inject information into each event.

Please refer to this answer for a full example of using the RewriteAppender to mask sensitive content.

Remko Popma
  • 35,130
  • 11
  • 92
  • 114