Understanding Sentry Relay’s Advanced PII Data‑Scrubbing Configuration

Basic Example

To replace all IP addresses in string fields, use the following JSON configuration:

{
  "applications": {
    "$string": ["@ip:replace"]
  }
}

@ip:replace

is the rule; $string is the selector.

Built‑in Rules

@ip:replace

and @ip:hash replace IP addresses. @imei:replace and @imei:hash replace IMEI values. @mac:replace, @mac:mask, @mac:hash target MAC addresses. @email:mask, @email:replace, @email:hash handle email addresses. @creditcard:mask, @creditcard:replace, @creditcard:hash handle credit‑card numbers. @userpath:replace and @userpath:hash match local file paths such as C:/Users/foo/. @password:remove deletes password‑like fields. @anything:remove, @anything:replace, @anything:hash act as wildcard regexes.

Writing Custom Rules

A rule consists of a type (what to match) and a redaction method (how to transform the value). Example configuration for a custom device‑ID rule:

{
  "publicKeys": [{
    "publicKey": "___PUBLIC_KEY___",
    "isEnabled": true
  }],
  "config": {
    "allowedDomains": ["*"],
    "piiConfig": {
      "rules": {
        "device_id": {
          "type": "pattern",
          "pattern": "d/[a-f0-9]{12}",
          "redaction": {"method": "hash"}
        }
      },
      "applications": {"freeform": ["device_id"]}
    }
  }
}

Interactive Editing

Paste a raw SDK JSON payload into the Piinguin PII configuration editor, click the data you want to remove, and copy the generated rules back into .relay/projects/<PROJECT_ID>.json.

PII Rule Types

pattern

: custom PCRE regex. imei: matches IMEI or IMEISV. mac: matches a MAC address. ip: matches any IP address. creditcard: matches credit‑card numbers. userpath: matches local file paths (e.g., C:/Users/foo/). anything: matches any value (wildcard regex). multiple: logical OR of several rules. alias: aliases a single rule.

Example of a pattern rule that hashes a device ID:

{
  "rules": {
    "hash_device_id": {
      "type": "pattern",
      "pattern": "d/[a-f0-9]{12}",
      "redaction": {"method": "hash"}
    }
  },
  "applications": {"$string": ["hash_device_id"]}
}

PII Editing Methods

remove

: deletes the entire field (or sets it to null). replace: substitutes a static string. mask: replaces each character with *, preserving length. hash: replaces the value with a deterministic hash; identical inputs produce identical hashes.

Example of a rule that hashes IP addresses:

{
  "rules": {
    "hash_ip": {
      "type": "ip",
      "redaction": {"method": "hash"}
    }
  },
  "applications": {"$string": ["hash_ip"]}
}

PII Selectors

Selectors limit a rule to specific parts of an event. Examples:

Delete the entire user object: [Remove] [Anything] from [$user] Delete all local variables in every frame: [Remove] [Anything] from [$frame.vars] Selectors can target JSON value types such as $string, $number, $datetime, $array, $object, and contextual sections like $exception, $stacktrace, $request, $user, $logentry, $thread, $breadcrumb, $span, $sdk.

Boolean Logic

Prefix ! to invert a selector (e.g., !foo matches everything except key foo).

Use && for logical AND (e.g., foo && !extra.foo).

Use || for logical OR (e.g., foo || bar).

Wildcards

**

matches all sub‑paths (e.g., foo.** matches any nested key under foo). * matches a single path segment (e.g., foo.* matches immediate children of foo).

Escaping Special Characters

If a key contains spaces or special characters, wrap it in quotes: [Remove] [Anything] from [extra.'my special value']. To escape a single quote inside the key, double it: my special '' value.

References

Relay repository: https://github.com/getsentry/relay

Advanced Data Scrubbing documentation: https://docs.sentry.io/product/data-management-settings/scrubbing/advanced-datascrubbing/

PII Selectors reference: https://develop.sentry.dev/pii/selectors/

PII Rule Types reference: https://develop.sentry.dev/pii/types/

PII Editing Methods reference: https://develop.sentry.dev/pii/methods/

Piinguin interactive editor: https://getsentry.github.io/piinguin/