Allow replace by Regex capture groups

README.md

@@ -4,22 +4,25 @@ A Fluent filter plugin to anonymize records which have PAN (Primary Account Numb
 
 Inspired by [fluent-plugin-anonymizer](https://github.com/y-ken/fluent-plugin-anonymizer).
 
+**N.B.:** This fork adds ability to allow Regex capture group usage, so that you can mask partially. The configuration shows how to set first 6 and last 4 numbers available while masking the values in between. See the example below.
+
 # Requirements
 
 - fluentd: v0.14.x or later
 - Ruby: 2.4 or later
 
 # Installation
 
-```
-gem install fluent-plugin-pan-anonymizer
+```shell
+fluent-gem install specific_install
+fluent-gem specific_install https://github.com/zbalkan/fluent-plugin-pan-anonymizer.git
 ```
 
 # Configuration
 
 NOTE: Card numbers in the example don't exist in the world.
 
-```
+```XML
 <source>
   @type dummy
   tag dummy
@@ -62,6 +65,71 @@ NOTE: Card numbers in the example don't exist in the world.
 
 Card numbers were masked with given configuration except `time` key and `4567890123456789` in "hello inquiry code is 4567890123456789". `4567890123456789` is not a valid card number.
 
+
+## A more complex example
+
+This example reads logs of an application called `sample`, masks and saves under `/var/log/masked/` so that you can use the masked version. This example uses `td-agent`.
+
+```XML
+<source>
+  @type tail
+  # update the path
+  path /var/log/sample.log
+  pos_file /var/log/td-agent/sample.log.pos
+
+  # Use the source application name as a tag below:
+  tag sample
+
+  # We don't care about the type and format of log.
+  # We will explicitly assume that it is plain text.
+  <parse>
+    @type none
+  </parse>
+</source>
+
+# Use the name of application used in the "tag" above
+<filter sample*>
+  @type pan_anonymizer
+  ignore_keys time
+
+ <pan>
+    # mastercard
+    formats /(5[1-5][0-9]{2}(?:\ |\-|)[0-9]{2})[0-9]{2}(?:\ |\-|)[0-9]{4}(?:\ |\-|)([0-9]{4})/
+    checksum_algorithm luhn
+    mask \1******\2
+  </pan>
+  <pan>
+    # visa
+    formats /(4[0-9]{3}(?:\ |\-|)[0-9]{2})[0-9]{2}(?:\ |\-|)[0-9]{4}(?:\ |\-|)([0-9]{4})/
+    checksum_algorithm luhn
+    mask \1******\2
+  </pan>
+  <pan>
+    # amex
+    formats /((?:34|37)[0-9]{2}(?:\ |\-|)[0-9]{2})[0-9]{4}(?:\ |\-|)[0-9]{1}([0-9]{4})/
+    checksum_algorithm luhn
+    mask \1******\2
+  </pan>
+</filter>
+
+# Use the name of application used in the "tag" above
+<match sample*>
+  @type file
+  # Logs will be saved under this folder
+  # Name will be buffer.<GUID>.log
+  # At the end of the day, it will rename the file as
+  # buffer.<date>.log
+  path /var/log/masked
+  append true
+</match>
+
+# Push fluentd messages to stdout
+<label @FLUENT_LOG>
+  <match fluent.*>
+    @type stdout
+  </match>
+</label>
+```
 # License
 
 Apache License, Version 2.0

fluent-plugin-pan-anonymizer.gemspec

@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name          = "fluent-plugin-pan-anonymizer"
-  spec.version       = "0.0.1"
+  spec.version       = "0.0.1.1"
   spec.authors       = ["Hiroaki Sano"]
   spec.email         = ["[email protected]"]
 

lib/fluent/plugin/pan/masker.rb

@@ -35,7 +35,7 @@ def mask_if_found_pan(orgval)
         pan = match.split("").select { |i| i =~ /\d/ }.map { |j| j.to_i }
 
         if valid?(pan)
-          match = @mask
+           match = match.gsub(@regexp, @mask)
         else
           match
         end