{
  "name": "mask_replaces_every_occurrence",
  "description": "mask replaces all matches in the field, not just the first -- redaction that stops at the first hit is a leak.",
  "rules": [
    {
      "match": [],
      "actions": [
        {
          "action": "mask",
          "field": "message",
          "pattern": "[0-9]{16}",
          "replacement": "[REDACTED]"
        }
      ]
    }
  ],
  "inputs": [
    {
      "timestamp_unix_nano": 1000,
      "host": "h1",
      "service": "s1",
      "severity": "SEVERITY_INFO",
      "message": "card 4111111111111111 and 5500000000000004 seen",
      "attributes": {}
    }
  ],
  "expect": [
    {
      "timestamp_unix_nano": 1000,
      "host": "h1",
      "service": "s1",
      "severity": "SEVERITY_INFO",
      "message": "card [REDACTED] and [REDACTED] seen",
      "attributes": {}
    }
  ]
}