Use the mask function for data masking

param rules

Example 1: Mask transaction data

A DeFi platform logs on-chain transactions that contain sensitive data such as wallet addresses and transaction hashes. This example masks the wallet, address, sourceIp, phone, and transactionHash fields, keeping the first 3 and last 3 characters for traceability.

• Raw data

  2025-08-20 18:04:40,998 INFO  blockchain-event-poller-3 [10.0.1.20] [com.service.listener.TransactionStatusListener:65] [TransactionStatusListener#handleSuccessfulTransaction]{"message":"On-chain transaction successfully confirmed","confirmationDetails":{"transactionHash":"0x2baf892e9a164b1979","status":"success","blockNumber":45101239,"gasUsed":189543,"effectiveGasPrice":"58.2 Gwei","userProfileSnapshot":{"wallet":"0x71C7656EC7a5f6d8A7C4","sourceIp":"203.0.113.55","phone":"19901012345","address":"No. 1000 Wenming Road, Pudong New Area, Shanghai","birthday":null}}}

• SPL statement

  SPL statement for the data processor:

  *| extend content =  mask(content,'[
             {"mode":"keyword","keys":["wallet","address","sourceIp","phone","transactionHash"], "maskChar":"*","keepPrefix":3,"keepSuffix":3}
           ]')

• Output

  2025-08-20 18:04: 40, 998 INFO blockchain-event-poller-3 [10.0.1.20][com.service.listener.TransactionStatusListener: 65]][TransactionStatusListener#handleSuccessfulTransaction]{"message": "On-chain transaction successfully confirmed", "confirmationDetails": {"transactionHash": "0×2**************979", "status": "success", "blockNumber": 45101239, "gasUsed": 189543, "effectiveGasPrice": "58.2 Gwei", "userProfileSnapshot": {"wallet": "0x7****************7C4", "sourceIp": "203******.55", "phone": "199*****345", "address": "Shanghai*********No. 00", "birthday": null}}}

Example 2: Mask sensitive URI parameters in NGINX logs

This example masks the uid and token parameters in a request URI, keeping the first 2 and last 2 characters.

• Raw data

  A typical API access log containing user identity and session tokens:

  http_protocol: HTTP/1.1
  remote_addrs: 127.0.0.1
  request_time:  5000
  status: 302
  time_local: 2025-08-19T18:52:03+08: 00
  uri: "uid=user12345&token=bf81639a41d604&from=web"
  user_agent: Mozilla/5.0(Windows NT 5.2; WOW64))AppleWebKit/535.1(
  (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1

• SPL statement

  Use keyword mode to selectively mask URI parameters:

  * | extend uri=mask(uri, '[
  {"mode": "keyword", "keys": ["uid", "loginIp", "token"],  "maskChar": "*", "keepPrefix": 2, "keepSuffix": 2}
  ]')

• Output

  http_protocol: HTTP/1.1
  remote_addrs: 127.0.0.1
  request_time:  5000
  status: 302
  time_local: 2025-08-19T18:52:03+08: 00
  uri: uid=us*****45&token=bf**********04&from=web
  user_agent: Mozilla/5.0(Windows NT 5.2; WOW64))AppleWebKit/535.1(
  (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1

Example 3: Mask large model interaction logs

An AI customer service platform receives user messages containing phone numbers, ID numbers, and credit card numbers. This example automatically detects and masks PII in user input while preserving text meaning for downstream analysis.

• Raw data

  A user message containing multiple types of PII:

  Hello, I need urgent help! I am a long-term paying user of your platform, my account seems to be locked, and an annual membership renewal has failed. I am in a hurry because I need to use your advanced features to complete a project tonight.
  Here is all my information. Please have your system administrator or technical support verify and resolve the issue for me immediately:
  Name: Zhang Wei
  Registered mobile number: 19901012345
  Registered email address: zhangwei.service@example.com
  Last logon IP address: 203.0.113.55
  ID card number: 110105199003070033
  The credit card information used for payment is as follows:
  Credit card type: Visa
  Card number: 4539-1488-0343-6467
  Cardholder name: ZHANG WEI
  Expiration date: 12/25
  CVV code: 123
  Please handle this as soon as possible. Thank you very much! I really need your help!

• SPL statement

  • Use buildin mode to identify multiple types of sensitive information:

  • Rules breakdown:

    • Rule 1 fully masks IP addresses, email addresses, and landline phone numbers with *.

    • Rule 2 partially masks phone numbers, ID card numbers, and credit card numbers, keeping the first 3 and last 4 characters.

  * | extend content =  mask(content,'[
               {"mode":"buildin","types":["IP_ADDRESS","EMAIL","LANDLINE_PHONE"]},
               {"mode":"buildin","types":["PHONE","IDCARD","CREDIT_CARD"], "maskChar":"*","keepPrefix":3,"keepSuffix":4}
              ]')

• Output

  content: Hello, I need urgent help! I am a long-term paid user of your platform. My account seems to be locked, and a renewal payment for my annual membership failed. I am very anxious because I need to use your advanced features tonight to complete a project.
  Here is all my information. Please have your system administrator or technical support verify and resolve the issue for me immediately:
  Name: Zhang Wei
  Registered phone number is 199****2345
  Registered email is ****************************
  My last logon IP address was ************
  ID card number is 110***********0033
  The credit card information used for payment is as follows:
  Credit card type: Visa
  Card number is 453************6467
  Cardholder name: ZHANG WEI
  Expiration date: 12/25
  CVV code: 123
  Please handle this as soon as possible. Thank you very much! I really need your help!