# No\_log as a varible

**URL:** <https://forum.ansible.com/t/no-log-as-a-varible/41681>\
**Category:** Get Help\
**Tags:** aap\
**Created:** [April 11, 2025, 3:23pm UTC](https://forum.ansible.com/t/no-log-as-a-varible/41681 "2025-04-11T15:23:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dustin1530](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dustin1530/32/1291_2.png) [@dustin1530](https://forum.ansible.com/u/dustin1530)\
**Post date:** [April 11, 2025, 3:23pm UTC](https://forum.ansible.com/t/no-log-as-a-varible/41681/1 "2025-04-11T15:23:15Z")

</div>

I’m in the process of adding `no_log: true` to all of our playbook tasks that have secrets in them. However, we still want to be able to see the logs when troubleshooting in lower regions, and not have to change any values in our playbooks, as we are afraid someone will turn this off for troubleshooting, and forget to flip it back, then merge this into our production branch (peer reviews aren’t catching this at the moment). So I came up with the idea of using `no_log: "{{ ansible_verbosity == 0 }}"`. So no\_log will be true when we do not run the playbook with any verbosity, but when we enable any verbosity we will see the output.

However, my issue is I have a requirement for our production playbooks to always have `no_log: true` set. Everything that I have seen is that a Job Template name or Project name is not exposed to the playbook, we do have all our projects and job templates names with the development region in them.

Another idea I had was to use an extra\_var or a survey item on the Job Template. However, our AAP admin isn’t keen on going back and adding this to all our Job Templates.

Does anyone else have a solution for this? or additional ideas?

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [April 11, 2025, 4:07pm UTC](https://forum.ansible.com/t/no-log-as-a-varible/41681/2 "2025-04-11T16:07:27Z")

</div>

[Ansible Configuration Settings — Ansible Community Documentation](https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-no-log) is the closest thing, but this has less precedence than keywords, so it won’t override explicit `no_log: true` on tasks

---

<div class="post-metadata">

**Author:** ![iwt-cmd](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iwt-cmd/32/9120_2.png) [@iwt-cmd](https://forum.ansible.com/u/iwt-cmd)\
**Post date:** [April 16, 2025, 1:54pm UTC](https://forum.ansible.com/t/no-log-as-a-varible/41681/3 "2025-04-16T13:54:47Z")

</div>

Hi @dustin1530

I would be leaning towards the extra\_var or survey item with a default of ‘True’ (survey preferred in my opinion). Assuming you can remediate the playbook logic en masse, the survey or extra\_var setup could be done via either the API or config as code which would make the AAP setup faster.

Best regards,

Joe

---

<div class="post-metadata">

**Author:** ![wayt](https://avatars.discourse-cdn.com/v4/letter/w/3be4f8/32.png) [@wayt](https://forum.ansible.com/u/wayt)\
**Post date:** [April 23, 2025, 5:21am UTC](https://forum.ansible.com/t/no-log-as-a-varible/41681/4 "2025-04-23T05:21:14Z")

</div>

You might find solace in the special variables presented by Automation Controller / AWX like `awx_project_scm_branch` and `awx_job_scm_branch`. You could bake that into how you evaluate the `no_log` task parameter.

```yaml
- ansible.builtin.debug:
    var: my_sensitive_var
  no_log: >-
    {{
      true if awx_project_scm_branch == "main" else not ansible_verbosity
    }}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [May 23, 2025, 5:22am UTC](https://forum.ansible.com/t/no-log-as-a-varible/41681/5 "2025-05-23T05:22:13Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.