---
title: Redact processor
description: The Redact processor redacts sensitive data in a string field by matching grok patterns and replacing the matched content with a placeholder. To redact...
url: https://www.elastic.co/elastic/docs-builder/docs/3016/solutions/observability/streams/management/extract/redact
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud Serverless
  - Elastic Cloud on Kubernetes
  - Elastic Observability
  - Elastic Stack
  - Elasticsearch
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Planned
---

# Redact processor
The **Redact** processor redacts sensitive data in a string field by matching grok patterns and replacing the matched content with a placeholder.
To redact sensitive information:
1. Select **Create** → **Create processor**.
2. Select **Redact** from the **Processor** menu.
3. Set the **Source Field** to the field containing text you want to redact.
4. Set the **Patterns** to one or more grok patterns that match sensitive data (for example, IP addresses or email addresses).

This functionality uses the Elasticsearch [Redact processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3016/reference/enrich-processor/redact-processor) internally, but you configure it in Streamlang. Streamlang doesn't always have 1:1 parity with the ingest processor options and behavior. Refer to [Processor limitations and inconsistencies](/elastic/docs-builder/docs/3016/solutions/observability/streams/management/extract#streams-processor-inconsistencies).

## YAML reference

In [YAML mode](/elastic/docs-builder/docs/3016/solutions/observability/streams/management/extract#streams-editing-yaml-mode), configure the redact processor using the following parameters. For the complete Streamlang syntax, refer to the [Streamlang reference](https://www.elastic.co/elastic/docs-builder/docs/3016/solutions/observability/streams/management/streamlang).

| Parameter             | Type     | Required | Description                                                                          |
|-----------------------|----------|----------|--------------------------------------------------------------------------------------|
| `from`                | string   | Yes      | Source field to redact.                                                              |
| `patterns`            | string[] | Yes      | Grok patterns that match sensitive data.                                             |
| `pattern_definitions` | object   | No       | Custom pattern definitions.                                                          |
| `prefix`              | string   | No       | Prefix for the redacted placeholder. Defaults to `<`.                                |
| `suffix`              | string   | No       | Suffix for the redacted placeholder. Defaults to `>`.                                |
| `ignore_missing`      | boolean  | No       | When `true`, skip this processor if the source field is missing. Defaults to `true`. |

```yaml
- action: redact
  from: body.message
  patterns:
    - "%{IP:ip_address}"
```