Filter out sensitive information from logs

filter_logger.py

import logging
import re


class RedactingFilter(logging.Filter):
    def __init__(self, patterns):
        super(RedactingFilter, self).__init__()
        self._patterns = patterns

    def filter(self, record):
        record.msg = self.redact(record.msg)
        if isinstance(record.args, dict):
            for k in record.args.keys():
                record.args[k] = self.redact(record.args[k])
        else:
            record.args = tuple(self.redact(arg) for arg in record.args)
        return True

    def redact(self, msg):
        for pattern in self._patterns:
            msg = re.sub(pattern, "[redacted]", msg)
        return msg


logger = logging.getLogger()

stream_handler = logging.StreamHandler()
stream_formatter = logging.Formatter("%(asctime)s - %(name)s - %(levelname)s - %(message)s")

redacting_filter = RedactingFilter(
    patterns=[
        re.compile(r"(?i)\bsecret\b"),
        re.compile(r"(?i)\bpassword\b"),
    ]
)

stream_handler.setFormatter(stream_formatter)
stream_handler.addFilter(redacting_filter)

logger.setLevel(logging.DEBUG)
logger.addHandler(stream_handler)

logger.info("hello, this is a sEcRet")
logger.info("hello, this is a secret password")

# Output
# 2021-12-06 08:32:25,448 - root - INFO - hello, this is a [redacted]
# 2021-12-06 08:32:25,449 - root - INFO - hello, this is a [redacted] [redacted]