search

binaryseed / new_relic_absinthe

Absinthe Instrumentation for the New Relic Elixir Agent
https://hex.pm/packages/new_relic_absinthe
Apache License 2.0
19 stars 13 forks source link

Add config to filter out arguments from logs #15

Closed sgtpepper43 closed 4 years ago

sgtpepper43 commented 4 years ago

This adds the ability to filter out arguments by some config. Some explanation of why we added this is that one of our products is a chat app, and for compliance reasons we can't have message bodies in the logs, where any engineer can see them. So in our case we just set

config :new_relic_absinthe, filter_variables: ~w(body)

This matches how the absinthe logger handles it:

config :absinthe, Absinthe.Logger, filter_variables: ~w(body)

We could maybe leverage the existing Absinthe Logger config in some way, or maybe even use the Absinthe Logger to do the formatting/filtering, but if I remember right (this was from a while ago), I don't think the Absinthe Logger exposes that functionality.

Resolves #14

jamestelfer commented 4 years ago

WRT #14, the default behaviour to send all arguments should be opt-in, not opt out IMO. If you only find out afterwards, you already have a PII leak.

sgtpepper43 commented 4 years ago

Fair point, though since this is the same way Absinthe Logger works, you're going to have the same problem there, so either way you're going to have to explicitly opt-out, unless you can get the Absinthe team to switch it around. Though depending on your setup, leaking out to your logs might not be as bad as leaking out to new relic.

jared-mackey commented 4 years ago

I would love to see this reversed to a whitelist instead. Just to be safe :)

binaryseed commented 4 years ago

Thanks for this! I'm going to close in favor of https://github.com/binaryseed/new_relic_absinthe/pull/17 which uses the agent's existing config value for collecting arguments.

It's all-or-nothing, but we could consider a filter as a feature to add in the agent itself in the future.