expanso-production-log-pipeline

Process production logs through parsing, validation, enrichment, PII redaction, and routing.

1|Updated Feb 1, 2026
One-click install
npx skills add https://github.com/expanso-io/expanso-skills --skill expanso-production-log-pipeline
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: expanso-production-log-pipeline
Source: https://github.com/expanso-io/expanso-skills/tree/main/skills/recipes/production-log-pipeline
Command: npx skills add https://github.com/expanso-io/expanso-skills --skill expanso-production-log-pipeline

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill automates the ingestion, validation, enrichment, and routing of production logs, ensuring critical information is captured and processed efficiently.

Core Features & Use Cases

  • Log Ingestion: Accepts logs via an HTTP endpoint.
  • Data Validation & Enrichment: Parses JSON, validates fields, enriches with metadata like node ID and region, and calculates severity.
  • PII Redaction: Automatically redacts sensitive information like emails, SSNs, and credit card numbers from log messages and hashes IP addresses.
  • Intelligent Routing: Directs logs to Elasticsearch for search, S3 for archival, and triggers alerts for high-priority messages.
  • Use Case: Centralize and secure logs from various microservices, ensuring compliance and enabling quick incident response.

Quick Start

Run the production log pipeline using the provided shell script.

Frequently Asked Questions about expanso-production-log-pipeline

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automatically redact PII from production logs before routing to Elasticsearch and S3?

To redact PII from production logs, this pipeline automatically identifies and masks sensitive information like emails, SSNs, and credit card numbers, and hashes IP addresses before routing data to destinations like Elasticsearch and S3.

What is the best way to parse, validate, and enrich JSON log ingestion via HTTP?

The best way to parse JSON log ingestion via HTTP is using a multi-stage pipeline that validates fields and enriches logs with metadata like node ID and region, calculating severity dynamically through environment variable configuration.

Can I trigger alert webhooks for high-priority log messages in a data pipeline?

Yes, you can trigger alert webhooks for high-priority log messages. The pipeline features conditional routing that evaluates calculated severity and directs critical log entries to configured alert webhooks for incident response.

Does this production log pipeline support environment variable configuration for dynamic settings?

Yes, the production log pipeline supports environment variable configuration for dynamic settings. This allows you to flexibly define HTTP input parameters and routing destinations without altering the core processing scripts.

How do I route logs to multiple destinations like Elasticsearch for search and S3 for archival?

You route logs to multiple destinations by leveraging the pipeline's conditional routing logic, which simultaneously directs processed logs to Elasticsearch for search indexing and S3 for long-term archival storage.