rzaripov1990/mysterio repository overview

⁠mysterio

A masking reverse-proxy that sits between Grafana and your log/observability backends. Grafana talks to mysterio, never directly to Loki or Elasticsearch — mysterio forwards the request, and on the way back masks sensitive fields (IIN/BIN, names, phones, e-mails, tokens, card/account numbers, IPs, etc.) in the response before Grafana ever sees it.

Grafana ──HTTP(S)──▶ mysterio ──HTTP(S)──▶ Loki / Elasticsearch (upstream)
                         │
                         └── masks sensitive fields in the response

• Loki (/loki/*): every response is scanned line-by-line; JSON log lines are masked by key name (recursively, including JSON escaped inside a string field), and regex rules catch non-JSON formats (SQL, logfmt, bare values in a URL).
• Elasticsearch (/elastic/*): only _search/_msearch responses are masked, structurally, by walking each hit's _source and masking matching JSON keys. Other endpoints (_mapping, _field_caps, index listings) pass through untouched.
• Both backends are optional and independently toggled — run with just Loki, just Elasticsearch, or both.
• Auth headers (Authorization, Basic Auth) are passed through unchanged; mysterio does not store or substitute credentials.
• mysterio's own logs contain only request metadata (path, status, content-type) — never log content or secrets.
• An optional /test-me page lets you paste a candidate rules.yaml and a log line and preview the masked result, without touching the live rules.

⁠Env

https://github.com/rzaripov1990/mysterio⁠