nerdexam
Google

PROFESSIONAL-CLOUD-DEVOPS-ENGINEER · Question #40

You are running an application on Compute Engine and collecting logs through Stackdriver. You discover that some personally identifiable information (PII) is leaking into certain log entry fields…

The correct answer is A. Use the filter-record-transformer Fluentd filter plugin to remove the fields from the log entries in. To quickly prevent personally identifiable information (PII) from being written into new log entries on Compute Engine, you should use a Fluentd filter plugin to modify or remove fields at the agent level before logs are sent to Stackdriver.

Submitted by salim_om· Apr 18, 2026Managing a service incident

Question

You are running an application on Compute Engine and collecting logs through Stackdriver. You discover that some personally identifiable information (PII) is leaking into certain log entry fields. You want to prevent these fields from being written in new log entries as quickly as possible. What should you do?

Options

  • AUse the filter-record-transformer Fluentd filter plugin to remove the fields from the log entries in
  • BUse the fluent-plugin-record-reformer Fluentd output plugin to remove the fields from the log
  • CWait for the application developers to patch the application, and then verify that the log entries are
  • DStage log entries to Cloud Storage, and then trigger a Cloud Function to remove the fields and

How the community answered

(35 responses)
  • A
    80% (28)
  • B
    11% (4)
  • C
    6% (2)
  • D
    3% (1)

Why each option

To quickly prevent personally identifiable information (PII) from being written into new log entries on Compute Engine, you should use a Fluentd filter plugin to modify or remove fields at the agent level before logs are sent to Stackdriver.

AUse the filter-record-transformer Fluentd filter plugin to remove the fields from the log entries inCorrect

The `filter-record-transformer` Fluentd plugin allows for modifying, adding, or removing fields within log entries as they are being processed by the logging agent on the Compute Engine instance. This enables PII to be stripped or masked directly at the source, preventing it from ever being written to Cloud Logging, which addresses the 'as quickly as possible' and 'prevent these fields from being written' requirements.

BUse the fluent-plugin-record-reformer Fluentd output plugin to remove the fields from the log

The `fluent-plugin-record-reformer` is an output plugin, which processes logs for formatting and sending to a destination *after* they have been filtered and buffered, meaning PII would already have been processed internally and potentially stored temporarily before this plugin acts.

CWait for the application developers to patch the application, and then verify that the log entries are

Waiting for application developers to patch the application is a long-term solution that does not immediately prevent PII from being written in new log entries from the currently running application.

DStage log entries to Cloud Storage, and then trigger a Cloud Function to remove the fields and

Staging logs to Cloud Storage and then triggering a Cloud Function to remove PII means the PII is *already written* to Cloud Storage before removal, which does not prevent it from being written initially.

Concept tested: Fluentd log filtering for PII redaction

Source: https://docs.fluentd.org/filter/record_transformer

Topics

#Cloud Logging#Fluentd#PII Redaction#Log Filtering

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-DEVOPS-ENGINEER Practice