From f4e2c32721c04294ddcbbdabb9c645e5595aa97e Mon Sep 17 00:00:00 2001
From: Jose Diaz-Gonzalez <email@josediazgonzalez.com>
Date: Sat, 22 Nov 2025 21:57:53 -0500
Subject: [PATCH 1/2] feat: sanitize vector sink values in report output

It is not sanitized in json format output as that is used for automation, but this should remove the need to redact any potentially sensitive information that users have in the sink, such as a token.

Closes #8147
---
 plugins/logs/report.go | 29 +++++++++++++++++++++++++++--
 1 file changed, 27 insertions(+), 2 deletions(-)

diff --git a/plugins/logs/report.go b/plugins/logs/report.go
index 781ea486f..d815615b3 100644
--- a/plugins/logs/report.go
+++ b/plugins/logs/report.go
@@ -1,6 +1,9 @@
 package logs
 
 import (
+	"fmt"
+	"os"
+
 	"github.com/dokku/dokku/plugins/common"
 )
 
@@ -10,6 +13,7 @@ func ReportSingleApp(appName string, format string, infoFlag string) error {
 		return err
 	}
 
+	os.Setenv("DOKKU_REPORT_FORMAT", format)
 	flags := map[string]common.ReportFunc{
 		"--logs-computed-app-label-alias": reportComputedAppLabelAlias,
 		"--logs-computed-max-size":        reportComputedMaxSize,
@@ -68,7 +72,18 @@ func reportVectorGlobalImage(appName string) string {
 }
 
 func reportGlobalVectorSink(appName string) string {
-	return common.PropertyGet("logs", "--global", "vector-sink")
+	value := common.PropertyGet("logs", "--global", "vector-sink")
+	// only show the schema and sanitize the rest
+	if value != "" && os.Getenv("DOKKU_REPORT_FORMAT") == "stdout" {
+		sink, err := SinkValueToConfig("--global", value)
+		if err != nil {
+			return ""
+		}
+
+		return fmt.Sprintf("%s://redacted", sink["type"])
+	}
+
+	return ""
 }
 
 func reportMaxSize(appName string) string {
@@ -76,5 +91,15 @@ func reportMaxSize(appName string) string {
 }
 
 func reportVectorSink(appName string) string {
-	return common.PropertyGet("logs", appName, "vector-sink")
+	value := common.PropertyGet("logs", appName, "vector-sink")
+	if value != "" && os.Getenv("DOKKU_REPORT_FORMAT") == "stdout" {
+		sink, err := SinkValueToConfig(appName, value)
+		if err != nil {
+			return ""
+		}
+
+		return fmt.Sprintf("%s://redacted", sink["type"])
+	}
+
+	return ""
 }

From e60ebf12fa9fbe3479dc121fb7ed0dbf84d86355 Mon Sep 17 00:00:00 2001
From: Jose Diaz-Gonzalez <email@josediazgonzalez.com>
Date: Sun, 23 Nov 2025 00:11:05 -0500
Subject: [PATCH 2/2] fix: do not sanitize if the value was the one requested

---
 plugins/logs/report.go | 52 ++++++++++++++++++++++++++++--------------
 1 file changed, 35 insertions(+), 17 deletions(-)

diff --git a/plugins/logs/report.go b/plugins/logs/report.go
index d815615b3..a18402473 100644
--- a/plugins/logs/report.go
+++ b/plugins/logs/report.go
@@ -14,6 +14,7 @@ func ReportSingleApp(appName string, format string, infoFlag string) error {
 	}
 
 	os.Setenv("DOKKU_REPORT_FORMAT", format)
+	os.Setenv("DOKKU_REPORT_FLAG", infoFlag)
 	flags := map[string]common.ReportFunc{
 		"--logs-computed-app-label-alias": reportComputedAppLabelAlias,
 		"--logs-computed-max-size":        reportComputedMaxSize,
@@ -73,17 +74,25 @@ func reportVectorGlobalImage(appName string) string {
 
 func reportGlobalVectorSink(appName string) string {
 	value := common.PropertyGet("logs", "--global", "vector-sink")
-	// only show the schema and sanitize the rest
-	if value != "" && os.Getenv("DOKKU_REPORT_FORMAT") == "stdout" {
-		sink, err := SinkValueToConfig("--global", value)
-		if err != nil {
-			return ""
-		}
-
-		return fmt.Sprintf("%s://redacted", sink["type"])
+	if value == "" {
+		return value
 	}
 
-	return ""
+	if os.Getenv("DOKKU_REPORT_FORMAT") != "stdout" {
+		return value
+	}
+
+	if os.Getenv("DOKKU_REPORT_FLAG") == "--logs-global-vector-sink" {
+		return value
+	}
+
+	// only show the schema and sanitize the rest
+	sink, err := SinkValueToConfig("--global", value)
+	if err != nil {
+		return ""
+	}
+
+	return fmt.Sprintf("%s://redacted", sink["type"])
 }
 
 func reportMaxSize(appName string) string {
@@ -92,14 +101,23 @@ func reportMaxSize(appName string) string {
 
 func reportVectorSink(appName string) string {
 	value := common.PropertyGet("logs", appName, "vector-sink")
-	if value != "" && os.Getenv("DOKKU_REPORT_FORMAT") == "stdout" {
-		sink, err := SinkValueToConfig(appName, value)
-		if err != nil {
-			return ""
-		}
-
-		return fmt.Sprintf("%s://redacted", sink["type"])
+	if value == "" {
+		return value
 	}
 
-	return ""
+	if os.Getenv("DOKKU_REPORT_FORMAT") != "stdout" {
+		return value
+	}
+
+	if os.Getenv("DOKKU_REPORT_FLAG") == "--logs-vector-sink" {
+		return value
+	}
+
+	// only show the schema and sanitize the rest
+	sink, err := SinkValueToConfig(appName, value)
+	if err != nil {
+		return ""
+	}
+
+	return fmt.Sprintf("%s://redacted", sink["type"])
 }