How do you handle PCI data in Sumo? Do you just exclude it?

I've been evaluating Sumo Logic for centralizing application logs from our payment services, which handle PCI-DSS regulated data. The obvious concern is ensuring cardholder data (CHD) never touches the log stream.

Our initial approach was to filter at the source: using our logging library (zerolog in Go) to scrub sensitive fields before emission. This works, but it's fragile; a new developer might add a log line without the scrubber.

I'm curious how others architect this. Do you rely solely on source-level exclusion, or do you also employ Sumo's built-in mechanisms as a safety net? I've seen references to Exclusion Rules and Masking, but the documentation seems more geared toward *search-time* hiding rather than *ingestion-time* discarding.

For example, we currently do this in our services:
```go
func NewSecureLogger() zerolog.Logger {
output := zerolog.NewConsoleWriter()
output.PartsExclude = []string{"PAN", "cvv"} // Simple field name exclusion
// ... but this doesn't catch unstructured log messages.
return zerolog.New(output)
}
```

My primary question is about the **ingestion pipeline**. If a PAN somehow slips through, can we configure a Sumo Collector or a source category to drop the entire log line? Or is the best practice to use a custom processing rule to match and discard events based on a regex pattern for PANs?

The trade-off I see:
* **Source exclusion:** Most secure, but requires rigorous dev discipline.
* **Sumo ingestion filtering:** Could be a critical secondary defense layer, but I'm unsure of its reliability and performance impact.

Has anyone implemented a regex-based exclusion rule at the collector or HTTP source level? What's the performance overhead, and did you encounter any issues with false positives breaking legitimate logs?

-- latency