# Remove task loop item from output **URL:** \ **Category:** Ansible Project\ **Created:** [June 5, 2014, 6:15pm UTC](https://forum.ansible.com/t/remove-task-loop-item-from-output/15413 "2014-06-05T18:15:48Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Thom\_Seddon](https://avatars.discourse-cdn.com/v4/letter/t/e47774/32.png) [@Thom\_Seddon](https://forum.ansible.com/u/Thom_Seddon)\ **Post date:** [June 5, 2014, 6:15pm UTC](https://forum.ansible.com/t/remove-task-loop-item-from-output/15413/1 "2014-06-05T18:15:48Z")
When you use a loop in an ansible task, e.g. with\_items or with\_dict, a dump of the item is included in the output. Sometimes these items contain secure infomation which it is undesirable to have output on screen, for example: ` ---
**Author:** ![Nadir\_Lloret](https://avatars.discourse-cdn.com/v4/letter/n/df705f/32.png) [@Nadir\_Lloret](https://forum.ansible.com/u/Nadir_Lloret)\ **Post date:** [June 10, 2014, 1:46pm UTC](https://forum.ansible.com/t/remove-task-loop-item-from-output/15413/2 "2014-06-10T13:46:19Z")
I was facing some similar problem. Mine is just that the dictionary being included in the output has too many values that it makes output messy and I would prefer just to include dict.key at the item=() output. It would be really nice to be able to decide if all the item or just a part of it is printed to the output. ---
**Author:** ![Scott\_Sturdivant](https://avatars.discourse-cdn.com/v4/letter/s/f14d63/32.png) [@Scott\_Sturdivant](https://forum.ansible.com/u/Scott_Sturdivant)\ **Post date:** [June 10, 2014, 5:28pm UTC](https://forum.ansible.com/t/remove-task-loop-item-from-output/15413/3 "2014-06-10T17:28:46Z")
This is something I’d be quite interested in as well. All of our private data is stored via ansible-vault, but then it winds up being displayed in plain text as the playbook executes. In a slightly contrived example, I’ve got an encrypted users.yml file that has user passwords. In my playbook, I pass the variable to the users module as “with\_items: users”, and wind up seeing all of the passwords, exactly like Thom pasted above. Certainly the argument can be made that since I knew the vault password, I could go look up that information anyway, but I’m more concerned with someone looking over my shoulder, or the output being some where I don’t control (Jenkins, for instance). So nothing valuable to add to this discussion, only hoping to see what others have done to work around this! ---
**Author:** ![Ernest0x](https://avatars.discourse-cdn.com/v4/letter/e/ed655f/32.png) [@Ernest0x](https://forum.ansible.com/u/Ernest0x)\ **Post date:** [June 11, 2014, 9:04am UTC](https://forum.ansible.com/t/remove-task-loop-item-from-output/15413/4 "2014-06-11T09:04:33Z")
This is indeed a security weakness (unnecessary exposure of sensitive data). So, I propose the introduction of a new playbook directive called ‘sensitive\_keys’ with a list of keys that are considered to hold sensitive data. Then, at output (logs / console output), all variables would be recursively checked if they contain a key that is included in the ‘sensitive\_keys’ list. If a key is matched, its value would be replaced with a ‘hidden’ version. For example: So, the following var: would have this ‘hidden’ version at logs / console output: As a proactive measure, if ‘sensitive\_keys’ is not explicitly set, it could include ‘password’ by default. Also, for debugging purposes or to speed up things if users are not interested in that measure, a configuration option that disables all this could be introduced. What do you think? ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [June 11, 2014, 10:38pm UTC](https://forum.ansible.com/t/remove-task-loop-item-from-output/15413/5 "2014-06-11T22:38:02Z")
We’re not going to be adding anything called “sensitive\_keys”, especially as filtering is not just about sensitivity. Tasks take a “no\_log: True” attribute to prevent their output from hitting syslog, easiest is to also make this automatically dock the verbosity in the callback. ---
**Author:** ![Ernest0x](https://avatars.discourse-cdn.com/v4/letter/e/ed655f/32.png) [@Ernest0x](https://forum.ansible.com/u/Ernest0x)\ **Post date:** [June 12, 2014, 10:32am UTC](https://forum.ansible.com/t/remove-task-loop-item-from-output/15413/6 "2014-06-12T10:32:33Z")
Ok, this would surely be a fine solution to the problem of being able to protect from over the shoulder watchers. I was about to open a new github issue but it seems there are at least 3 open issues for this. 🙂