Skip to content

[Logger] Add structured log context filtering - #386

Open
RedZapdos123 wants to merge 2 commits into
rage-rb:mainfrom
RedZapdos123:issue-370-log-redaction
Open

[Logger] Add structured log context filtering#386
RedZapdos123 wants to merge 2 commits into
rage-rb:mainfrom
RedZapdos123:issue-370-log-redaction

Conversation

@RedZapdos123

@RedZapdos123 RedZapdos123 commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Description:

Issue #370 asked for a built-in way to filter sensitive values from Rage's structured log context.

This PR adds config.filter_parameters, which applies Rails-style case-insensitive partial matching to structured context keys and replaces matching values with [FILTERED] before the log entry is written.

The implementation stays inside Rage's own logger code and applies consistently to with_context, inline logger context, request log context added through append_info_to_payload, global config.log_context, and dynamic external logger context payloads.

As discussed in the issue, this PR only filters structured context. It does not change request_info.

It also adds regression specs for logger filtering, configuration wiring, nested structured context, and the unchanged request_info behavior for dynamic external loggers.

Closes #370.

Checklist:

  • I have added relevant regression test cases for this change.
  • I have run linting checks using bundle exec rubocop lib/rage/logger/logger.rb lib/rage/configuration.rb spec/logger_spec.rb spec/configuration_spec.rb.
  • I have run focused specs using bundle exec rspec spec/logger_spec.rb spec/configuration_spec.rb.
  • I have run syntax checks using bundle exec ruby -c lib/rage/logger/logger.rb && bundle exec ruby -c lib/rage/configuration.rb.

Before the fix:

Sensitive keys in structured log context were written as-is.

Rage did not have a built-in filtering mechanism for with_context, inline logger context, or request log context merged through append_info_to_payload.

Example:

[my_test_tag] timestamp=... level=info password_confirmation=secret AUTH_TOKEN=abc user_id=12345 message=passed

After the fix:

config.filter_parameters filters matching structured context keys before log emission.

Matching is case-insensitive and partial, so keys like password_confirmation and AUTH_TOKEN are filtered.

Nested hashes and arrays are filtered recursively.

Dynamic external loggers receive filtered context and unchanged request_info.

Example:

[my_test_tag] timestamp=... level=info password_confirmation=[FILTERED] AUTH_TOKEN=[FILTERED] user_id=12345 message=passed

Signed-off-by: Mridankan Mandal <xerontitan90@gmail.com>
Signed-off-by: Mridankan Mandal <xerontitan90@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Logger] Redact sensitive information from logs

1 participant