Hiding sensitive data from logging

[Cellard]

How to replace passwords, tokens, etc in log context with ***?

We can append custom message processor only to custom monolog logger, but what about single or daily predefined drivers?

[MLuc24]

tap isn't limited to the monolog driver — it works on single and daily too. It's applied in LogManager::get(), which is the resolution path every channel goes through regardless of driver:

return $this->channels[$name] ?? with($this->resolve($name, $config), function ($logger) use ($name) {
    $loggerWithContext = $this->tap(
        $name,
        new Logger($logger, $this->app['events'])
    )->withContext($this->sharedContext);

and tap() just reads the key off whatever config that channel has:

foreach ($this->configurationFor($name)['tap'] ?? [] as $tap) {
    [$class, $arguments] = $this->parseTap($tap);

    $this->app->make($class)->__invoke($logger, ...explode(',', $arguments));
}

So nothing there cares which driver produced the logger. Add the key to your existing channel in config/logging.php:

'daily' => [
    'driver' => 'daily',
    'path' => storage_path('logs/laravel.log'),
    'tap' => [App\Logging\RedactSensitive::class],
    // ...
],

and have the tap push a Monolog processor:

namespace App\Logging;

use Monolog\LogRecord;

class RedactSensitive
{
    public function __invoke($logger): void
    {
        foreach ($logger->getLogger()->getHandlers() as $handler) {
            $handler->pushProcessor(function (LogRecord $record) {
                return $record->with(context: $this->redact($record->context));
            });
        }
    }
}

Note the $logger handed to __invoke is Laravel's wrapper, so getLogger() gets you the Monolog instance underneath. Pushing onto the handlers rather than the logger matters if you ever add a second handler to that channel — a logger-level processor runs for all of them, a handler-level one only for that handler, and for redaction you want it to apply everywhere.

Since parseTap splits arguments on commas, you can also parameterise it as 'tap' => [RedactSensitive::class.':password,token,secret'] and take the key list as arguments rather than hardcoding it, which is handy if different channels need different rules.

[nirav-gajera]

tap isn't limited to a custom driver — it works on any channel in config/logging.php, including the built-in single and daily ones, since under the hood they're all just Monolog-backed loggers Laravel assembles from config. You don't need a separate custom channel just to attach a processor.

// config/logging.php
'channels' => [
    'daily' => [
        'driver' => 'daily',
        'path' => storage_path('logs/laravel.log'),
        'level' => env('LOG_LEVEL', 'debug'),
        'days' => 14,
        'tap' => [App\Logging\RedactSensitiveData::class],
    ],
],

The tap class receives the Illuminate\Log\Logger instance and pushes a Monolog processor onto it:

namespace App\Logging;

class RedactSensitiveData
{
    public function __invoke($logger): void
    {
        foreach ($logger->getHandlers() as $handler) {
            $handler->pushProcessor(new SensitiveDataProcessor);
        }
    }
}

Then the processor itself does the actual redaction, walking the context array and masking anything matching your sensitive keys:

namespace App\Logging;

use Monolog\LogRecord;
use Monolog\Processor\ProcessorInterface;

class SensitiveDataProcessor implements ProcessorInterface
{
    protected array $keys = ['password', 'token', 'secret', 'api_key', 'authorization'];

    public function __invoke(LogRecord $record): LogRecord
    {
        $record['context'] = $this->redact($record['context']);

        return $record;
    }

    protected function redact(array $context): array
    {
        foreach ($context as $key => $value) {
            if (is_array($value)) {
                $context[$key] = $this->redact($value);
            } elseif (in_array(strtolower((string) $key), $this->keys, true)) {
                $context[$key] = '***';
            }
        }

        return $context;
    }
}

Attach the same tap array to single, daily, or any stack channel and it applies the same way — nothing about the built-in drivers excludes them from tap. If you want it applied globally without adding tap to every channel individually, you can also add it to the stack channel's array only, since stack fans out to whichever channels it wraps and the processor gets attached at the handler level either way.

One thing worth double-checking regardless of this: Laravel's exception handler already redacts common sensitive input keys (password, password_confirmation, etc.) via the dontFlash/hidden config in bootstrap/app.php (or App\Exceptions\Handler on older versions) before they hit session flash data — but that's a separate mechanism from channel logging and won't cover custom Log::info('...', [...]) calls, which is why you still need the processor for anything you log yourself.