Hide sensitive GET parameters within nginx access logs thanks to the Lua module

nginx.conf

http {
    log_format  filt  '$remote_addr - $remote_user [$time_local] "$_request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    server {
        
        location /login {
          # `set` is provided by the Rewrite module
          set $filter "password|secret";
          
          set_by_lua $_request '
            local filt = ngx.arg[1]
            local req = ngx.arg[2]
            return ngx.re.gsub(req, "((" .. filt .. ")=)[^&]+", "$1-FILTERED-")
          ' $filter $request;
          
          access_log  logs/access.log  filt;

          # ...          
        }
    }
}

http://nginx.2469901.n2.nabble.com/Remove-query-parameter-td5187941.html

    location /xxx {
        #Strip password in access.log
        set $temp $request;
        if ($temp ~ (.*)password=[^&]*(.*)) { 
            set $temp $1password=****$2;
        }
        log_format filter '$remote_addr - $remote_user [$time_local]  '
                            '"$temp" $status $body_bytes_sent '
                            '"$http_referer" "$http_user_agent"';
        access_log  logs/access.log filter;
    }

Thanks for this alternative!

The above alternative from @Rockes won't work because you can't have log_format directives inside location blocks. It can only exist inside http blocks.

Hi! This works for me: https://serverfault.com/questions/1046249/exclude-a-specific-query-parameter-from-being-logged-in-nginx