[rsyslog-notify] Forum Thread: Re: How can I replace a string with '****' in output - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24800#p24800

Message: 
----------
what you are trying to do would need a message modification module

There is an existing module that anonymizes IP addresses, something very
much like it could do userids as well, the issue is how do you recognize
what a userid looks like without matching other thing.

if you are storing the full log message as a single string, your best bet
is to use the external message modification module mmexternal and then you
can use perl to modify the message

If you parse the message apart and store the components, just overwrite the
userid variable after it's parsed apart (probably by mmnormalize)