Add --redaction option to log forwarding integrations - #117
Conversation
35e88d8 to
4319d05
Compare
There was a problem hiding this comment.
Pull request overview
Adds an opt-in boolean configuration field for log-forwarding integrations so users can enable PII redaction via the CLI (intended to prevent sensitive data from being forwarded off-host unredacted).
Changes:
- Introduces a
redactionBooleanField on integrations, gated to log-forwarding integration types. - Defaults the new setting to
false(opt-in) and exposes it as a CLI option through the existing ConsoleForm wiring.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
PR upsun#20 extracted the six log-forwarding integration types into a variable. Use it here instead of a fourth copy of the list, so adding or removing a type updates every conditional field at once. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
pjcdawkins
left a comment
pjcdawkins
left a comment
There was a problem hiding this comment.
Reviewed and merging. Verified the field shape against agilis origin/master: Redaction bool on containers.LogsForwarderConfig, applied in transport.Forwarder.forwardEvent and shared by all six forwarders, so the six-type condition is right and false is the correct default.
I pushed one commit and merged main in. PR #20 landed just before this and extracted the six log-forwarding types into $logForwardingTypes; the redaction condition now uses that variable instead of a fourth copy of the list, so adding or removing a type updates every conditional field at once. No behavior change.
Two things I checked that turned out not to be problems, for the record:
integration:adddoes not transmitredaction: falseunnecessarily — an absent flag yields no value rather than the field default.- The help text is accurate about what the built-in rule set covers.
Docs follow-up is mine: the forward-logs.md property table and the generated CLI reference need --redaction and --excluded-services from #20. One pass for both.
Enables opt-in PII redaction for log lines forwarded via log forwarding integrations. When enabled, agilis strips sensitive data (e.g. email addresses) from log lines before they leave the host — satisfying the PCI-DSS requirement to never transmit PII off-machine unredacted.
Defaults to false (opt-in).