Redaction belongs in the shipping pipeline, not the application

Removing personal data at the call site catches what you thought about; removing it at the shipper catches the debug line somebody adds next year in a code path nobody reviewed.

filter {
  mutate {
    remove_field => [ "[request][password]", "[request][card_number]",
                      "[request][cvv]", "[headers][authorization]" ]
  }

  mutate {
    gsub => [ "message", "[\w.+-]+@[\w-]+\.[\w.]+", "[EMAIL]" ]
  }
}

The regular expression will occasionally redact something harmless, and that is the correct trade — a field list covers what is known today and the pattern covers what is not. Both have to be in place before the first document, because deleting from an index is far harder than never indexing. Aggregated logs are readable by everyone with an account, so this is the difference between a searchable archive and a searchable archive of things people typed into a checkout form.