Hide sensitive GET parameters within nginx access logs thanks to the Lua module

nginx.conf

http {
    log_format  filt  '$remote_addr - $remote_user [$time_local] "$_request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    server {
        
        location /login {
          # `set` is provided by the Rewrite module
          set $filter "password|secret";
          
          set_by_lua $_request '
            local filt = ngx.arg[1]
            local req = ngx.arg[2]
            return ngx.re.gsub(req, "((" .. filt .. ")=)[^&]+", "$1-FILTERED-")
          ' $filter $request;
          
          access_log  logs/access.log  filt;

          # ...          
        }
    }
}