Spring Integration logging with sensitive information

Question

I recently add si to my project and have been very happy with it. I'm having an issue with my logging. I am using logback and all works ok; however, I have sensitive information flowing through the system that cannot be logged "as is". Certain data must be intercepted and masked before logging. If I configure my log level below WARN then I see this sensitive info. What is the best way to filter all messages bound for logging? I am using a inbound gateway with a service activator for an si server. I am using an async outbound gateway for an si client.

Answer 1

It isn't clear how the logging is relevant to the Spring Integration.

Seems for me it's enough to write some custom Appender accodrding to your logging framework.

From other side you can filter messages before log them using SI <filter> and <logging-channel-adapter> after <filter>.

But in this case you can't use logger.debug() (or similar) from your code: you alway should send the message to the channel for logging.

Please, explain further from where and how you want to filter (or mask) logging messages.

Answer 2

Using logback and slf4j I used this to mask the si messages...

public class LoggingFilter extends TurboFilter {
    private static final Marker secured = MarkerFactory.getMarker("secured");

    @Override
    public FilterReply decide(Marker marker, Logger logger, Level level, String format, Object[] params, Throwable t) {
        if (format != null && logger.getName().startsWith("org.springframework.integration")) {
            boolean isSecured = marker != null && (marker.equals(secured) || marker.contains(secured));
            if (isSecured) {
                return NEUTRAL;
            } else {
                if (marker == null) {
                    marker = secured;
                } else {
                    marker.add(secured);
                }
                String message = MessageFormatter.arrayFormat(format, params).getMessage();
                //TODO: mask message here.
                logger.log(marker, logger.getName(), toLocationAwareLoggerInteger(level), message, null, t);
                return DENY;
            }
        } else {
            return NEUTRAL;
        }
    }
}