# Regex that applied field masking, which works in OpenSearch 2x but not in OpenSearch 3x

**URL:** <https://forum.opensearch.org/t/regex-that-applied-field-masking-which-works-in-opensearch-2x-but-not-in-opensearch-3x/27559>\
**Category:** Security\
**Created:** [November 28, 2025, 3:34am UTC](https://forum.opensearch.org/t/regex-that-applied-field-masking-which-works-in-opensearch-2x-but-not-in-opensearch-3x/27559 "2025-11-28T03:34:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![chirumanem](https://avatars.discourse-cdn.com/v4/letter/c/22d042/32.png) [@chirumanem](https://forum.opensearch.org/u/chirumanem)\
**Post date:** [November 28, 2025, 3:34am UTC](https://forum.opensearch.org/t/regex-that-applied-field-masking-which-works-in-opensearch-2x-but-not-in-opensearch-3x/27559/1 "2025-11-28T03:34:07Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch 3.3.0

**Describe the issue** : We recently moved from Opensearch 2.19.0 to Opensearch 3.3.0.  
For certain fields, we are using partial field masking. According to this forum discussion: [Pattern-based field masking disables the search](https://forum.opensearch.org/t/pattern-based-field-masking-disables-the-search/9565) , we realize that a role with masked\_fields cannot query on masked fields since it is purposefully prohibited by the 3pp. However, the logs were visible in the Opensearch 2.19.0 version.  
After we just upgraded to Opensearch 3.3.0, we saw that the role with masked\_fields could no longer see logs at all, not only query.

Checking the logs, we found this error:  
“org.opensearch.security.privileges.PrivilegesConfigurationValidationException: A regular expression needs to be wrapped in /…”

Then, we updated the regex by wrapping it like:- /pattern/ , now it’s working.

old one:-  
masked\_fields:

- “message::(\[(admin)?priv\d\*\]._?\[/(admin)?priv\d_\])::\*"
- "extra\_data._::(\[(admin)?priv\d\*\]._?\[/(admin)?priv\d\*\])::\*”

new one:-  
masked\_fields:

- “message::/(\[(admin)?priv\d\*\]._?\[/(admin)?priv\d_\])/::\*"
- "extra\_data._::/(\[(admin)?priv\d\*\]._?\[/(admin)?priv\d\*\])/::\*”

We want to know if the OS upgrade included stronger regex validation in masked\_fields.

**Configuration** :

old one:-  
masked\_fields:

- “message::(\[(admin)?priv\d\*\]._?\[/(admin)?priv\d_\])::\*"
- "extra\_data._::(\[(admin)?priv\d\*\]._?\[/(admin)?priv\d\*\])::\*”

new one:-  
masked\_fields:

- “message::/(\[(admin)?priv\d\*\]._?\[/(admin)?priv\d_\])/::\*"
- "extra\_data._::/(\[(admin)?priv\d\*\]._?\[/(admin)?priv\d\*\])/::\*”

**Relevant Logs or Screenshots** :

“org.opensearch.security.privileges.PrivilegesConfigurationValidationException: A regular expression needs to be wrapped in /…”

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [November 28, 2025, 6:24pm UTC](https://forum.opensearch.org/t/regex-that-applied-field-masking-which-works-in-opensearch-2x-but-not-in-opensearch-3x/27559/2 "2025-11-28T18:24:31Z")

</div>

@chirumanem According to OpenSearch documentation, the notation `<field>::/<regular-expression>/::<replacement-string>` was always required. It could be that it wasn’t enforced. OpenSearch documentation has followed this format since 1.x

> **[Field masking](https://docs.opensearch.org/latest/security/access-control/field-masking/#advanced-pattern-based-field-masking)**
>
> Field masking

---

<div class="post-metadata">

**Author:** ![chirumanem](https://avatars.discourse-cdn.com/v4/letter/c/22d042/32.png) [@chirumanem](https://forum.opensearch.org/u/chirumanem)\
**Post date:** [November 29, 2025, 12:35am UTC](https://forum.opensearch.org/t/regex-that-applied-field-masking-which-works-in-opensearch-2x-but-not-in-opensearch-3x/27559/3 "2025-11-29T00:35:36Z")

</div>

> [@chirumanem](#):
>
> old one:-  
> masked\_fields:
> 
> - “message::([(admin)?priv\d\*]._?[/(admin)?priv\d_])::\*"
> - "extra\_data._::([(admin)?priv\d_]._?[/(admin)?priv\d_])::\*”

Hi @pablo ,  
Thank you for responding and clarifying. Then how this worked until the 2x version, but not simply with the new upgrade. This strict regex inspection applies only to the new uplift, not to the beginning.

Regards,

Chiranjeevi