{"id":13674,"date":"2020-05-21T17:23:25","date_gmt":"2020-05-21T21:23:25","guid":{"rendered":"http:\/\/www.iri.com\/blog\/?p=13674"},"modified":"2026-02-23T17:55:04","modified_gmt":"2026-02-23T22:55:04","slug":"find-and-mask-elasticsearch","status":"publish","type":"post","link":"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/","title":{"rendered":"How to Find and Mask PII in Elasticsearch"},"content":{"rendered":"<p><em><strong>Editor&#8217;s Note:<\/strong> A newer version of the IRI DarkShield wizard for Elasticsearch data masking is described in <a href=\"https:\/\/www.iri.com\/blog\/data-protection\/finding-and-masking-nosql-dbs-with-the-darkshield-gui\/\">this article<\/a>.\u00a0<\/em><\/p>\n<p>Elasticsearch is a Java-based search engine that has an HTTP interface and stores its data in schema-free JSON documents. Unfortunately, a spate of costly and painful breaches of Personally Identifiable Information (PII) continue to plague online Elasticsearch databases:<\/p>\n<p><a href=\"\/blog\/wp-content\/uploads\/2020\/05\/elasticsearch-breach.png\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-13723 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2020\/05\/elasticsearch-breach.png\" alt=\"\" width=\"442\" height=\"645\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/elasticsearch-breach.png 598w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/elasticsearch-breach-206x300.png 206w\" sizes=\"(max-width: 442px) 100vw, 442px\" \/><\/a><\/p>\n<p>Were all the PII or other sensitive information in these DBs masked however, successful hacks and development copies may <a href=\"https:\/\/www.iri.com\/blog\/data-protection\/beyond-the-breach\/\">not be problematic<\/a>. Indeed, Elasticsearch security best practices should not rely strictly on endpoint security, which can be forgotten or bypassed.<\/p>\n<p>To more effectively protect PII in Elasticsearch, you can use a purpose-built job wizard in the IRI <a href=\"https:\/\/www.iri.com\/products\/workbench\/darkshield-gui\">GUI for DarkShield<\/a> to lock down data in production or test collections using privacy-law-compliant data anonymization functions.<\/p>\n<p>The <i>Elasticsearch search and mask wizard<\/i> in the IRI Workbench graphical IDE for <a href=\"https:\/\/www.iri.com\/products\/darkshield\">IRI DarkShield<\/a> uses the same tooling as the MongoDB and Cassandra connectors described in this <a href=\"https:\/\/www.iri.com\/blog\/data-protection\/mongodb-cassandra-darkshield\/\">article<\/a>. This wizard can be used to classify, locate, and de-identify or delete PII and other sensitive information held on Elasticsearch collections, and to produce search and audit results.<\/p>\n<h4><b>Set Up<\/b><\/h4>\n<p>If you do not have an Elasticsearch cluster to connect to, you can easily create a local cluster by\u00a0 downloading Elasticsearch from <a href=\"https:\/\/www.elastic.co\/downloads\/elasticsearch\">here<\/a> and following the <a href=\"https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/current\/install-elasticsearch.html\">instruction guide<\/a>.<\/p>\n<p>For my demonstration of this wizard, I am using a single index called <i>customers <\/i>on a locally hosted cluster. This index stores basic customer information that would normally be seen in an account, and be a rich target for malfeasance. This includes: email, name, and phone number:<\/p>\n<p><a href=\"http:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/results-searched.png\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-13676 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2020\/05\/results-searched-405x1024.png\" alt=\"\" width=\"407\" height=\"1029\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/results-searched-405x1024.png 405w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/results-searched-119x300.png 119w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/results-searched.png 411w\" sizes=\"(max-width: 407px) 100vw, 407px\" \/><\/a><\/p>\n<h4><b>Search<\/b><\/h4>\n<p>As with the other data sources DarkShield supports, you must create a <i>.dsc<\/i> job specification file to define your scanning and market criteria. As you would with MongoDB or Cassandra, select the <i>New NoSQL Search\/Masking Job &#8230;<\/i> from the DarkShield Menu atop the IRI Workbench toolbar. Select a project folder and enter a name for the job.<\/p>\n<p>On the next page, create a source URI:<\/p>\n<p><a href=\"\/blog\/wp-content\/uploads\/2020\/05\/elasticsearch-new-source.png\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-13677 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2020\/05\/elasticsearch-new-source.png\" alt=\"\" width=\"530\" height=\"441\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/elasticsearch-new-source.png 532w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/elasticsearch-new-source-300x250.png 300w\" sizes=\"(max-width: 530px) 100vw, 530px\" \/><\/a><\/p>\n<p>Here is where you enter the parameters for your Elasticsearch cluster. The default host and port for Elasticsearch are localhost and 9200 if these fields are left blank.<\/p>\n<p>If the cluster to which you are connecting needs a username and password, enter those in the authentication section. For this example, I am using host: localhost, port: 9200, and the cluster: Elasticsearch.<\/p>\n<p><a href=\"\/blog\/wp-content\/uploads\/2020\/05\/customers-url.png\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-13678 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2020\/05\/customers-url.png\" alt=\"\" width=\"553\" height=\"482\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/customers-url.png 671w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/customers-url-300x262.png 300w\" sizes=\"(max-width: 553px) 100vw, 553px\" \/><\/a><\/p>\n<p>A username and password can also be added on this page. For the simplicity of this demonstration, the local cluster has not been configured with security in mind. Any real cluster should have login and permissions enabled for real use cases.<\/p>\n<p>Click <b>OK <\/b>to finish and you will be returned to the previous page. Type in the index you would like to search. In this example, I am using the index named <i>customers<\/i>.<\/p>\n<p><a href=\"\/blog\/wp-content\/uploads\/2020\/05\/elasticsearch-source.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-13679 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2020\/05\/elasticsearch-source.png\" alt=\"\" width=\"532\" height=\"443\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/elasticsearch-source.png 532w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/elasticsearch-source-300x250.png 300w\" sizes=\"(max-width: 532px) 100vw, 532px\" \/><\/a><\/p>\n<p>Next, you will need to set a target URI for the masked results. Keep in mind that only Elasticsearch masked results can only be sent to Elasticsearch targets. In this case, I will be using the same Customers URI created before but with a different index. This will create a new index with the masked results that will be created later on in this demonstration.<\/p>\n<p><a href=\"\/blog\/wp-content\/uploads\/2020\/05\/elasticsearch-target.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-13680 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2020\/05\/elasticsearch-target.png\" alt=\"\" width=\"532\" height=\"443\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/elasticsearch-target.png 532w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/elasticsearch-target-300x250.png 300w\" sizes=\"(max-width: 532px) 100vw, 532px\" \/><\/a><\/p>\n<p>Next, you will be asked to create a Search Matcher, which is responsible for associating a Data Class with a corresponding Data (Masking) Rule. This is a necessary step as no masking can be applied without it.<\/p>\n<p><a href=\"\/blog\/wp-content\/uploads\/2020\/05\/search-matcher-blank.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-13681 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2020\/05\/search-matcher-blank.png\" alt=\"\" width=\"522\" height=\"487\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/search-matcher-blank.png 522w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/search-matcher-blank-300x280.png 300w\" sizes=\"(max-width: 522px) 100vw, 522px\" \/><\/a><\/p>\n<p>As explained in the <a href=\"https:\/\/www.iri.com\/blog\/vldb-operations\/data-classification-in-iri-workbench\/\">Data Classification<\/a> article, Data Classes centrally catalog and define global criteria for finding and masking PII in structured, semi-structured or unstructured sources for both FieldShield and DarkShield. IRI Workbench ships with several predefined data classes (e.g., names, email and IP addresses, credit card numbers), found in <i>Window &gt; Preferences &gt; IRI &gt; Data Classes and Groups<\/i>. You can edit those and add your own.<\/p>\n<p>Click <b>Browse <\/b>or <b>Create <\/b>on the Data Class line. Browse will let you select your own data classes, or one of several predefined classes or groups, including email, phone number, and names. In this case the NAMES data class group includes a first names data class.<\/p>\n<p><a href=\"\/blog\/wp-content\/uploads\/2020\/05\/data-class-dropmenu.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-13682 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2020\/05\/data-class-dropmenu.png\" alt=\"\" width=\"509\" height=\"442\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/data-class-dropmenu.png 509w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/data-class-dropmenu-300x261.png 300w\" sizes=\"(max-width: 509px) 100vw, 509px\" \/><\/a><\/p>\n<p>Here I selected the EMAIL data class that will look for emails within my Elasticsearch index:<\/p>\n<p><a href=\"\/blog\/wp-content\/uploads\/2020\/05\/search-matcher-emails.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-13699 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2020\/05\/search-matcher-emails.png\" alt=\"\" width=\"522\" height=\"487\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/search-matcher-emails.png 522w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/search-matcher-emails-300x280.png 300w\" sizes=\"(max-width: 522px) 100vw, 522px\" \/><\/a><\/p>\n<p>Now a masking rule must be applied to the data class that has been chosen. Click the <b>Create <\/b>button to make a new data rule, or <b>Browse <\/b>to use any you may have defined already.<\/p>\n<p><a href=\"\/blog\/wp-content\/uploads\/2020\/05\/new-data-rule.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-13695 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2020\/05\/new-data-rule.png\" alt=\"\" width=\"511\" height=\"635\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/new-data-rule.png 511w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/new-data-rule-241x300.png 241w\" sizes=\"(max-width: 511px) 100vw, 511px\" \/><\/a><\/p>\n<p>For Emails, I choose a redaction function:<\/p>\n<p><a href=\"\/blog\/wp-content\/uploads\/2020\/05\/finished-search-matcher-email.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-13694 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2020\/05\/finished-search-matcher-email.png\" alt=\"\" width=\"522\" height=\"487\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/finished-search-matcher-email.png 522w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/finished-search-matcher-email-300x280.png 300w\" sizes=\"(max-width: 522px) 100vw, 522px\" \/><\/a><\/p>\n<p>More than one data class can be masked simultaneously of course. I added classes and assigned a format-preserving encryption function to phone numbers, and a random pseudonym (set file lookup) for people\u2019s names:<\/p>\n<p><a href=\"\/blog\/wp-content\/uploads\/2020\/05\/search-matchers-full.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-13700 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2020\/05\/search-matchers-full.png\" alt=\"\" width=\"692\" height=\"443\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/search-matchers-full.png 692w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/search-matchers-full-300x192.png 300w\" sizes=\"(max-width: 692px) 100vw, 692px\" \/><\/a><\/p>\n<p>If any search filters are needed, they can be added on the prior page. Filters can be used to find particular results, or to isolate specific fields in CSV, XML, JSON or RDBs to be masked, precluding the need for scanning row contents. I did not specify any in this case, however.<\/p>\n<p>Click <b>Finish <\/b>when done. This completes the wizard and creates a <i>.search<\/i> file which holds the DarkShield configuration details for executing the search and\/or masking job(s).<\/p>\n<p><b>Note:<\/b> If you are using the default locally hosted cluster like the one in this example, make sure that the cluster is on, because any search or masking jobs will fail otherwise. You can check if the server is running by opening a web browser and typing \u201chttp:\/\/localhost:9200\/\u201d into the address bar.<\/p>\n<h4><b>Searching and Masking<\/b><\/h4>\n<p>DarkShield supports searching and masking as separate or simultaneous operations. In this case, I want to search first and see what I\u2019ve found before I mask it. That\u2019s because (larger) masking jobs can take time, and I may want to hone my search methods and re-verify them.<\/p>\n<p>To do this, right click the DarkShield job configuration (.dsc) file and run the file as a search job. This\u00a0 creates an <em>annotations.json<\/em> file<i>\u00a0<\/i>you can run later as a <i>masking <\/i>job to remediate the collection with the redaction function(s) specified. You can also search and mask at the same time instead.<\/p>\n<p>The previously searched results will be masked in the target location. To verify this, you can perform a search again and see that the data has now been \u201cDarkShield\u2019ed\u201d as specified; i.e., emails redacted, first names pseudonymized, and phone numbers masked with format-preserving encryption:<\/p>\n<p><a href=\"http:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/results-masked.png\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-13696 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2020\/05\/results-masked-456x1024.png\" alt=\"\" width=\"407\" height=\"914\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/results-masked-456x1024.png 456w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/results-masked-134x300.png 134w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/results-masked.png 463w\" sizes=\"(max-width: 407px) 100vw, 407px\" \/><\/a><\/p>\n<p>If you want to learn how to anonymize data in Elasticsearch collections by masking their data at rest via this DarkShield interface in IRI Workbench, or via CLI or API, please email <a href=\"mailto:darkshield@iri.com\">darkshield@iri.com<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Editor&#8217;s Note: A newer version of the IRI DarkShield wizard for Elasticsearch data masking is described in this article.\u00a0 Elasticsearch is a Java-based search engine that has an HTTP interface and stores its data in schema-free JSON documents. Unfortunately, a spate of costly and painful breaches of Personally Identifiable Information (PII) continue to plague online<\/p>\n<div><a class=\"btn-filled btn\" href=\"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/\" title=\"How to Find and Mask PII in Elasticsearch\">Read More<\/a><\/div>\n","protected":false},"author":115,"featured_media":13724,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[108,8,91,3,2255],"tags":[14,13,1469,1470,1388,850,149],"class_list":["post-13674","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-big-data-2","category-data-protection","category-iri-workbench","category-vldb-operations","category-archived-articles","tag-data-masking","tag-data-protection-2","tag-elasticsearch","tag-elasticsearch-data-masking","tag-iri-darkshield","tag-iri-workbench","tag-pii"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v23.4 (Yoast SEO v23.4) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How to Find and Mask PII in Elasticsearch - IRI<\/title>\n<meta name=\"description\" content=\"Protect your sensitive information in Elasticsearch databases with IRI DarkShield. Learn how to mask PII and ensure privacy compliance.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Find and Mask PII in Elasticsearch\" \/>\n<meta property=\"og:description\" content=\"Protect your sensitive information in Elasticsearch databases with IRI DarkShield. Learn how to mask PII and ensure privacy compliance.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/\" \/>\n<meta property=\"og:site_name\" content=\"IRI\" \/>\n<meta property=\"article:published_time\" content=\"2020-05-21T21:23:25+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-02-23T22:55:04+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/elasticthumbnail.png\" \/>\n\t<meta property=\"og:image:width\" content=\"671\" \/>\n\t<meta property=\"og:image:height\" content=\"585\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Craig Schein\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Craig Schein\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/\"},\"author\":{\"name\":\"Craig Schein\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/803e7bda27760374008e0dee86eee2bd\"},\"headline\":\"How to Find and Mask PII in Elasticsearch\",\"datePublished\":\"2020-05-21T21:23:25+00:00\",\"dateModified\":\"2026-02-23T22:55:04+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/\"},\"wordCount\":1101,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/elasticthumbnail.png\",\"keywords\":[\"data masking\",\"data protection\",\"Elasticsearch\",\"Elasticsearch data masking\",\"IRI DarkShield\",\"IRI Workbench\",\"PII\"],\"articleSection\":[\"Big Data\",\"Data Masking\/Protection\",\"IRI Workbench\",\"VLDB\",\"Archived Articles\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/\",\"url\":\"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/\",\"name\":\"How to Find and Mask PII in Elasticsearch - IRI\",\"isPartOf\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/elasticthumbnail.png\",\"datePublished\":\"2020-05-21T21:23:25+00:00\",\"dateModified\":\"2026-02-23T22:55:04+00:00\",\"description\":\"Protect your sensitive information in Elasticsearch databases with IRI DarkShield. Learn how to mask PII and ensure privacy compliance.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/#primaryimage\",\"url\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/elasticthumbnail.png\",\"contentUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/elasticthumbnail.png\",\"width\":671,\"height\":585},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.iri.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Find and Mask PII in Elasticsearch\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.iri.com\/blog\/#website\",\"url\":\"https:\/\/www.iri.com\/blog\/\",\"name\":\"IRI\",\"description\":\"Total Data Management Blog\",\"publisher\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.iri.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\",\"name\":\"IRI\",\"url\":\"https:\/\/www.iri.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png\",\"contentUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png\",\"width\":750,\"height\":206,\"caption\":\"IRI\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/803e7bda27760374008e0dee86eee2bd\",\"name\":\"Craig Schein\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/dd64a949f0641d95a87230cabec062d5?s=96&d=blank&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/dd64a949f0641d95a87230cabec062d5?s=96&d=blank&r=g\",\"caption\":\"Craig Schein\"},\"url\":\"https:\/\/www.iri.com\/blog\/author\/craigs\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"How to Find and Mask PII in Elasticsearch - IRI","description":"Protect your sensitive information in Elasticsearch databases with IRI DarkShield. Learn how to mask PII and ensure privacy compliance.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/","og_locale":"en_US","og_type":"article","og_title":"How to Find and Mask PII in Elasticsearch","og_description":"Protect your sensitive information in Elasticsearch databases with IRI DarkShield. Learn how to mask PII and ensure privacy compliance.","og_url":"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/","og_site_name":"IRI","article_published_time":"2020-05-21T21:23:25+00:00","article_modified_time":"2026-02-23T22:55:04+00:00","og_image":[{"width":671,"height":585,"url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/elasticthumbnail.png","type":"image\/png"}],"author":"Craig Schein","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Craig Schein","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/#article","isPartOf":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/"},"author":{"name":"Craig Schein","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/803e7bda27760374008e0dee86eee2bd"},"headline":"How to Find and Mask PII in Elasticsearch","datePublished":"2020-05-21T21:23:25+00:00","dateModified":"2026-02-23T22:55:04+00:00","mainEntityOfPage":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/"},"wordCount":1101,"commentCount":0,"publisher":{"@id":"https:\/\/www.iri.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/#primaryimage"},"thumbnailUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/elasticthumbnail.png","keywords":["data masking","data protection","Elasticsearch","Elasticsearch data masking","IRI DarkShield","IRI Workbench","PII"],"articleSection":["Big Data","Data Masking\/Protection","IRI Workbench","VLDB","Archived Articles"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/","url":"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/","name":"How to Find and Mask PII in Elasticsearch - IRI","isPartOf":{"@id":"https:\/\/www.iri.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/#primaryimage"},"image":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/#primaryimage"},"thumbnailUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/elasticthumbnail.png","datePublished":"2020-05-21T21:23:25+00:00","dateModified":"2026-02-23T22:55:04+00:00","description":"Protect your sensitive information in Elasticsearch databases with IRI DarkShield. Learn how to mask PII and ensure privacy compliance.","breadcrumb":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/#primaryimage","url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/elasticthumbnail.png","contentUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/elasticthumbnail.png","width":671,"height":585},{"@type":"BreadcrumbList","@id":"https:\/\/www.iri.com\/blog\/data-protection\/find-and-mask-elasticsearch\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.iri.com\/blog\/"},{"@type":"ListItem","position":2,"name":"How to Find and Mask PII in Elasticsearch"}]},{"@type":"WebSite","@id":"https:\/\/www.iri.com\/blog\/#website","url":"https:\/\/www.iri.com\/blog\/","name":"IRI","description":"Total Data Management Blog","publisher":{"@id":"https:\/\/www.iri.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.iri.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.iri.com\/blog\/#organization","name":"IRI","url":"https:\/\/www.iri.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png","contentUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png","width":750,"height":206,"caption":"IRI"},"image":{"@id":"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/803e7bda27760374008e0dee86eee2bd","name":"Craig Schein","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/dd64a949f0641d95a87230cabec062d5?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/dd64a949f0641d95a87230cabec062d5?s=96&d=blank&r=g","caption":"Craig Schein"},"url":"https:\/\/www.iri.com\/blog\/author\/craigs\/"}]}},"jetpack_featured_media_url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2020\/05\/elasticthumbnail.png","_links":{"self":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/13674"}],"collection":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/users\/115"}],"replies":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/comments?post=13674"}],"version-history":[{"count":11,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/13674\/revisions"}],"predecessor-version":[{"id":18403,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/13674\/revisions\/18403"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/media\/13724"}],"wp:attachment":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/media?parent=13674"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/categories?post=13674"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/tags?post=13674"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}