filtering out sensitive data in workflow from conductor logs

[ritu-p]

We observed that data passed to workflow which can be sensitive in nature is getting printed in conductor logs.
Is there a way to filter this out?

[aravindanr]

Can you elaborate this a bit? Are you referring to workflow input/output or task input/output? If yes, we could consider filtering them out in the logs.

[ritu-p]

Yes, we didn't want the sensitive data that we send as i/p to workflow to be printed in logs.
Is there some example available to mask this data in logs via log4j.properties?

[aravindanr]

Understood. Currently, there is no way to mask just sensitive information out a log entry, but the log entry in whole can be disabled. It's hard to narrow down to just one entry, you may end up disabling all logs from a specific class. For instance, to disable all logs from WorkflowExecutor, you can add this to the properties file,

logging.level.com.netflix.conductor.core.execution.WorkflowExecutor=off

If you know the specific instances in code where sensitive information is logged, please bring it to our attention and we can check if those can be removed altogether.