Stop pasting raw logs into ChatGPT

Leo — Mon, 12 Oct 2026 18:34:27 +0000

You know the workflow. Something breaks, you grab the log, paste it into ChatGPT or Copilot, and ask what went wrong. It works. The AI spots the pattern in seconds.

Here is the part nobody likes to think about. That log contains your internal IP scheme, user principal names, SIDs, maybe a bearer token someone left in a header. You just handed all of it to a third party. Most of us have done it. I wanted a small habit that makes it safer.

The idea is simple: make a redacted copy first, paste that instead. But dumb redaction breaks troubleshooting. If every IP becomes [REDACTED], the AI cannot tell which server talked to which, and the whole exercise falls apart. So each distinct value gets its own stable token. 10.0.4.21 becomes [IP-1] everywhere it appears. jdoe@contoso.com becomes [UPN-1]. The AI can still follow the story from box to box. It just cannot see your network.

What it catches

IPv4 and IPv6 addresses, email addresses and UPNs, DOMAIN\user names, GUIDs, SIDs, JWTs, bearer tokens, Basic auth headers, API keys, JSON secrets (passwords, tokens, client secrets), Azure SAS signatures, storage account keys. If your logs have their own formats like customer reference numbers, you can pass your own regex and those get stable tokens too.

A quick before and after. Say your log has this:

2026-10-12 01:14:22 ERROR Auth failed for jdoe@contoso.com from 10.0.4.21, token eyJhbGciOi...
2026-10-12 01:14:23 WARN  Retry from 10.0.4.21 for jdoe@contoso.com

The sanitized copy reads:

2026-10-12 01:14:22 ERROR Auth failed for [UPN-1] from [IP-1], token [TOKEN-1]
2026-10-12 01:14:23 WARN  Retry from [IP-1] for [UPN-1]

Timestamps and error messages are untouched, so the AI can still diagnose. The values are gone, but the relationships between them survive. That is the whole trick.

The script

Single file, no modules, works on PowerShell 5.1 and 7.x. Originals are never modified. Redacted copies go to a Sanitized folder next to the input. It prints a redaction map so you can trace tokens back later, and with -SaveMap it writes the map to a file. Keep that map local. Never share it.

Protect-LogFile -Path 'C:\Cases\INC123\*.log'

Add your own patterns:

Protect-LogFile -Path '.\firewall.log' -CustomPatterns 'CustomerRef-\d{6}'

Or flatten everything to one token with no map:

Protect-LogFile -Path '.\firewall.log' -ReplacementToken '[REDACTED]'

It supports -WhatIf like a well behaved cmdlet, validates your custom regex before writing anything, and never silently overwrites a previous run. The full script is in the free download linked below.

Two honest caveats. Regex redaction is a safety net, not a guarantee. Review the redacted copy before you share it, especially if your logs contain hostnames or ticket IDs that identify a customer. Those need custom patterns. And four part version numbers like 4.8.4.0 look like IPv4 addresses to a regex, so skim the output when those appear.

Why stable tokens instead of deletion

I tried plain deletion first. The AI kept asking "which server?" and I kept re reading the original log to answer, which defeated the purpose. Stable tokens preserve the shape of the problem while removing the identity of the parts. In practice the AI diagnoses just as well from the tokenized copy, because troubleshooting is about relationships and sequences, not about the literal values.

Get it

Full disclosure: I built this. It is free here: https://mightyleo.gumroad.com/l/ojbhki

It is also one of ten tools in a bigger bundle I sell for $19: thirty environment aware prompts, ten PowerShell tools, ten checklists, at https://mightyleo.gumroad.com/l/ai-playbook-for-it-engineers. The sanitizer stays free regardless. If the script misses a pattern in your logs, tell me in the comments and I will add it.

DEV Community: Leo

Stop pasting raw logs into ChatGPT

What it catches

The script

Why stable tokens instead of deletion

Get it