For the convenience of analyzing we save the `$request_body` field in access log. However, there are some sensitive information inside the post body, such as password or credit card number, exposed in the logs. How can we mask these information? 

```
password=1234asdf  ->  password=****

```

If I write a nginx module to mask the data, should I write a new log module or should I manipulate the request body before the original log module called?  

Or should I use nginx-lua to achieve this goal?  

Or is there any other methods?