data_drain 0.2.1 → 0.3.0

data/lib/data_drain/configuration.rb

@@ -6,10 +6,13 @@ module DataDrain
   # Contenedor para todas las opciones de configuración del motor DataDrain.
   class Configuration
     attr_accessor :storage_mode, :aws_region,
-      :aws_access_key_id, :aws_secret_access_key,
-      :db_host, :db_port, :db_user, :db_pass, :db_name,
-      :batch_size, :throttle_delay, :logger, :limit_ram, :tmp_directory,
-      :idle_in_transaction_session_timeout
+                  :aws_access_key_id, :aws_secret_access_key,
+                  :db_host, :db_port, :db_user, :db_pass, :db_name,
+                  :batch_size, :throttle_delay, :logger, :limit_ram, :tmp_directory,
+                  :idle_in_transaction_session_timeout,
+                  :vacuum_after_purge,
+                  :slow_batch_threshold_s,
+                  :slow_batch_alert_after
 
     def initialize
       @storage_mode   = :local
@@ -20,12 +23,59 @@ module DataDrain
       @limit_ram      = nil # eg 2GB
       @tmp_directory  = nil # eg /tmp/duckdb_work
       @idle_in_transaction_session_timeout = 0
-      @logger         = Logger.new($stdout)
+      @vacuum_after_purge = false
+      @slow_batch_threshold_s = 30
+      @slow_batch_alert_after = 5
+      @logger = Logger.new($stdout)
     end
 
     # @return [String] Cadena de conexión optimizada para DuckDB.
     def duckdb_connection_string
       "postgresql://#{@db_user}:#{@db_pass}@#{@db_host}:#{@db_port}/#{@db_name}?options=-c%20idle_in_transaction_session_timeout%3D#{@idle_in_transaction_session_timeout}"
     end
+
+    # Valida invariantes generales (storage_mode + AWS si aplica).
+    # Llamado por FileIngestor#initialize y GlueRunner.run_and_wait.
+    #
+    # @raise [DataDrain::ConfigurationError]
+    def validate!
+      validate_storage_mode!
+      validate_aws_config! if storage_mode.to_sym == :s3
+    end
+
+    # Valida además las credenciales PostgreSQL.
+    # Llamado por Engine#initialize.
+    #
+    # @raise [DataDrain::ConfigurationError]
+    def validate_for_engine!
+      validate!
+      validate_db_config!
+    end
+
+    private
+
+    def validate_storage_mode!
+      return if %i[local s3].include?(storage_mode.to_sym)
+
+      raise DataDrain::ConfigurationError,
+            "storage_mode debe ser :local o :s3, recibido #{storage_mode.inspect}"
+    end
+
+    def validate_aws_config!
+      return unless aws_region.nil? || aws_region.to_s.empty?
+
+      raise DataDrain::ConfigurationError,
+            "aws_region es obligatorio con storage_mode = :s3"
+    end
+
+    def validate_db_config!
+      %i[db_host db_user db_name].each do |attr|
+        val = public_send(attr)
+        next unless val.nil? || val.to_s.empty?
+
+        raise DataDrain::ConfigurationError,
+              "config.#{attr} es obligatorio para Engine (storage_mode=#{storage_mode})"
+      end
+    end
   end
 end

data/lib/data_drain/engine.rb

@@ -5,12 +5,12 @@ require "pg"
 
 module DataDrain
   # Motor principal de extracción y purga de datos (DataDrain).
-  # rubocop:disable Metrics/ClassLength, Metrics/AbcSize, Metrics/MethodLength, Naming/AccessorMethodName
   #
   # Orquesta el flujo ETL desde PostgreSQL hacia un Data Lake analítico
   # delegando la interacción del almacenamiento al adaptador configurado.
   class Engine
     include Observability
+    include Observability::Timing
     # Inicializa una nueva instancia del motor de extracción.
     #
     # @param options [Hash] Diccionario de configuración para la extracción.
@@ -42,6 +42,7 @@ module DataDrain
       @skip_export = options.fetch(:skip_export, false)
 
       @config = DataDrain.configuration
+      @config.validate_for_engine!
       @logger = @config.logger
       @adapter = DataDrain::Storage.adapter
 
@@ -49,70 +50,91 @@ module DataDrain
       @duckdb = database.connect
     end
 
-    # Ejecuta el flujo completo del motor: Setup, Conteo, Exportación (opcional), Verificación y Purga.
-    #
-    # @return [Boolean] `true` si el proceso finalizó con éxito, `false` si falló la integridad.
     def call
-      start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-      safe_log(:info, "engine.start",
-               { table: @table_name, start_date: @start_date.to_date, end_date: @end_date.to_date })
+      @durations = {}
+      start_time = monotonic
+      log_start
 
       setup_duckdb
+      return skip_empty(start_time) if step_count.zero?
 
-      # 1. Conteo inicial en Postgres
-      step_start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-      @pg_count = get_postgres_count
-      db_query_duration = Process.clock_gettime(Process::CLOCK_MONOTONIC) - step_start
-
-      if @pg_count.zero?
-        duration = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time
-        safe_log(:info, "engine.skip_empty",
-                 { table: @table_name, duration_s: duration.round(2), db_query_duration_s: db_query_duration.round(2) })
-        return true
-      end
-
-      # 2. Exportación
-      export_duration = 0.0
       if @skip_export
         safe_log(:info, "engine.skip_export", { table: @table_name })
       else
-        safe_log(:info, "engine.export_start", { table: @table_name, count: @pg_count })
-        step_start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        export_to_parquet
-        export_duration = Process.clock_gettime(Process::CLOCK_MONOTONIC) - step_start
+        step_export
       end
+      return integrity_failed(start_time) unless step_verify
 
-      # 3. Verificación de Integridad
-      step_start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-      integrity_ok = verify_integrity
-      integrity_duration = Process.clock_gettime(Process::CLOCK_MONOTONIC) - step_start
+      step_purge
+      log_complete(start_time)
+      true
+    end
 
-      if integrity_ok
-        # 4. Purga en Postgres
-        step_start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        purge_from_postgres
-        purge_duration = Process.clock_gettime(Process::CLOCK_MONOTONIC) - step_start
+    private
 
-        duration = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time
-        safe_log(:info, "engine.complete", {
-                   table: @table_name,
-                   duration_s: duration.round(2),
-                   db_query_duration_s: db_query_duration.round(2),
-                   export_duration_s: export_duration.round(2),
-                   integrity_duration_s: integrity_duration.round(2),
-                   purge_duration_s: purge_duration.round(2),
-                   count: @pg_count
-                 })
-        true
-      else
-        duration = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time
-        safe_log(:error, "engine.integrity_error",
-                 { table: @table_name, duration_s: duration.round(2), count: @pg_count })
-        false
-      end
+    # @api private
+    def log_start
+      safe_log(:info, "engine.start",
+               { table: @table_name, start_date: @start_date.to_date, end_date: @end_date.to_date })
     end
 
-    private
+    # @api private
+    def step_count
+      @pg_count = timed(:db_query) { get_postgres_count }
+      @pg_count
+    end
+
+    # @api private
+    def skip_empty(start_time)
+      duration = monotonic - start_time
+      safe_log(:info, "engine.skip_empty", {
+                 table: @table_name,
+                 duration_s: duration.round(2),
+                 db_query_duration_s: @durations.fetch(:db_query, 0).round(2)
+               })
+      true
+    end
+
+    # @api private
+    def step_export
+      safe_log(:info, "engine.export_start", { table: @table_name, count: @pg_count })
+      timed(:export) { export_to_parquet }
+    end
+
+    # @api private
+    def step_verify
+      timed(:integrity) { verify_integrity }
+    end
+
+    # @api private
+    def step_purge
+      timed(:purge) { purge_from_postgres }
+    end
+
+    # @api private
+    def log_complete(start_time)
+      duration = monotonic - start_time
+      safe_log(:info, "engine.complete", {
+                 table: @table_name,
+                 duration_s: duration.round(2),
+                 db_query_duration_s: @durations.fetch(:db_query, 0).round(2),
+                 export_duration_s: @durations.fetch(:export, 0).round(2),
+                 integrity_duration_s: @durations.fetch(:integrity, 0).round(2),
+                 purge_duration_s: @durations.fetch(:purge, 0).round(2),
+                 count: @pg_count
+               })
+    end
+
+    # @api private
+    def integrity_failed(start_time)
+      duration = monotonic - start_time
+      safe_log(:error, "engine.integrity_error", {
+                 table: @table_name,
+                 duration_s: duration.round(2),
+                 count: @pg_count
+               })
+      false
+    end
 
     # @api private
     # @return [String]
@@ -212,40 +234,129 @@ module DataDrain
         conn.exec("SET idle_in_transaction_session_timeout = #{@config.idle_in_transaction_session_timeout};")
       end
 
+      total_deleted = purge_loop(conn)
+
+      vacuum_if_needed(conn, total_deleted)
+    ensure
+      conn&.close
+    end
+
+    # @api private
+    def vacuum_if_needed(conn, total_deleted)
+      return unless @config.vacuum_after_purge
+      return if total_deleted.zero?
+
+      vacuum_start = monotonic
+      dead_before = fetch_dead_tuple_count(conn)
+
+      begin
+        conn.exec("VACUUM ANALYZE #{@table_name};")
+      rescue PG::Error => e
+        safe_log(:warn, "engine.vacuum_error", {
+          table: @table_name,
+          dead_tuples_before: dead_before,
+          rows_deleted_count: total_deleted,
+          duration_s: (monotonic - vacuum_start).round(2)
+        }.merge(exception_metadata(e)))
+        return
+      end
+
+      dead_after = fetch_dead_tuple_count(conn)
+      vacuum_duration = monotonic - vacuum_start
+
+      safe_log(:info, "engine.vacuum_complete", {
+                 table: @table_name,
+                 duration_s: vacuum_duration.round(2),
+                 dead_tuples_before: dead_before,
+                 dead_tuples_after: dead_after,
+                 rows_deleted_count: total_deleted
+               })
+    end
+
+    # @api private
+    def fetch_dead_tuple_count(conn)
+      result = conn.exec_params(
+        "SELECT n_dead_tup FROM pg_stat_user_tables WHERE relname = $1",
+        [@table_name]
+      )
+      result.first&.dig("n_dead_tup")&.to_i || 0
+    rescue PG::Error
+      -1
+    end
+
+    # @api private
+    # @param conn [PG::Connection]
+    # @return [Integer] total de filas borradas
+    def purge_loop(conn)
       batches_processed = 0
       total_deleted = 0
+      slow_batch_streak = 0
 
       loop do
-        sql = <<~SQL
-          DELETE FROM #{@table_name}
-          WHERE #{@primary_key} IN (
-            SELECT #{@primary_key} FROM #{@table_name}
-            WHERE #{base_where_sql}
-            LIMIT #{@config.batch_size}
-          )
-        SQL
-
-        result = conn.exec(sql)
+        batch_start = monotonic
+        result = conn.exec(build_delete_sql)
+        batch_duration = monotonic - batch_start
         count = result.cmd_tuples
         break if count.zero?
 
         batches_processed += 1
         total_deleted += count
 
-        # Heartbeat cada 100 lotes para monitorear procesos largos de 1TB
-        if (batches_processed % 100).zero?
-          safe_log(:info, "engine.purge_heartbeat", {
+        slow_batch_streak = handle_batch_timing(batch_duration, count, slow_batch_streak)
+        emit_heartbeat_if_due(batches_processed, total_deleted)
+
+        sleep(@config.throttle_delay) if @config.throttle_delay.positive?
+      end
+
+      total_deleted
+    end
+
+    # @api private
+    def handle_batch_timing(batch_duration, count, streak)
+      if batch_duration > @config.slow_batch_threshold_s
+        streak += 1
+        safe_log(:warn, "engine.slow_batch", {
+                   table: @table_name,
+                   batch_duration_s: batch_duration.round(2),
+                   batch_size: count,
+                   streak: streak,
+                   threshold_s: @config.slow_batch_threshold_s
+                 })
+
+        if streak == @config.slow_batch_alert_after
+          safe_log(:warn, "engine.purge_degraded", {
                      table: @table_name,
-                     batches_processed_count: batches_processed,
-                     rows_deleted_count: total_deleted
+                     consecutive_slow_batches: streak,
+                     hint: "considerar índice composite o particionamiento (ver postgres-tuning.md)"
                    })
         end
-
-        sleep(@config.throttle_delay) if @config.throttle_delay.positive?
+        streak
+      else
+        0
       end
-    ensure
-      conn&.close
+    end
+
+    # @api private
+    def emit_heartbeat_if_due(batches_processed, total_deleted)
+      return unless (batches_processed % 100).zero?
+
+      safe_log(:info, "engine.purge_heartbeat", {
+                 table: @table_name,
+                 batches_processed_count: batches_processed,
+                 rows_deleted_count: total_deleted
+               })
+    end
+
+    # @api private
+    def build_delete_sql
+      <<~SQL
+        DELETE FROM #{@table_name}
+        WHERE #{@primary_key} IN (
+          SELECT #{@primary_key} FROM #{@table_name}
+          WHERE #{base_where_sql}
+          LIMIT #{@config.batch_size}
+        )
+      SQL
     end
   end
-  # rubocop:enable Metrics/ClassLength, Metrics/AbcSize, Metrics/MethodLength, Naming/AccessorMethodName
 end

data/lib/data_drain/file_ingestor.rb

@@ -6,8 +6,7 @@ module DataDrain
   # aplicando compresión ZSTD y particionamiento Hive.
   class FileIngestor
     include Observability
-    # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity,
-    #   Metrics/MethodLength
+    include Observability::Timing
 
     # @param options [Hash] Opciones de ingestión.
     # @option options [String] :source_path Ruta absoluta al archivo local.
@@ -25,6 +24,7 @@ module DataDrain
       @bucket = options[:bucket]
 
       @config = DataDrain.configuration
+      @config.validate!
       @logger = @config.logger
       @adapter = DataDrain::Storage.adapter
 
@@ -35,46 +35,77 @@ module DataDrain
     # Ejecuta el flujo de ingestión.
     # @return [Boolean] true si el proceso fue exitoso.
     def call
-      start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      @durations = {}
+      start_time = monotonic
       safe_log(:info, "file_ingestor.start", { source_path: @source_path })
 
-      unless File.exist?(@source_path)
-        safe_log(:error, "file_ingestor.file_not_found", { source_path: @source_path })
-        return false
-      end
+      return file_not_found(start_time) unless step_validate_file
+
+      step_setup_duckdb
+      @reader_function = determine_reader
+      @source_count = step_count_source
+
+      return skip_empty(start_time) if @source_count.zero?
+
+      step_export
+      log_complete(start_time)
+      cleanup_local_file
+      true
+    rescue DuckDB::Error => e
+      duration = monotonic - start_time
+      safe_log(:error, "file_ingestor.duckdb_error",
+               { source_path: @source_path }.merge(exception_metadata(e)).merge(duration_s: duration.round(2)))
+      false
+    ensure
+      @duckdb&.close
+    end
+
+    private
+
+    # @api private
+    def file_not_found(_start_time)
+      safe_log(:error, "file_ingestor.file_not_found", { source_path: @source_path })
+      false
+    end
+
+    # @api private
+    def step_validate_file
+      File.exist?(@source_path)
+    end
 
+    # @api private
+    def step_setup_duckdb
       @duckdb.query("SET max_memory='#{@config.limit_ram}';") if @config.limit_ram.present?
       @duckdb.query("SET temp_directory='#{@config.tmp_directory}'") if @config.tmp_directory.present?
-
       @adapter.setup_duckdb(@duckdb)
+    end
 
-      # Determinamos la función lectora de DuckDB según la extensión del archivo
-      reader_function = determine_reader
-
-      # 1. Conteo de seguridad
-      step_start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-      source_count = @duckdb.query("SELECT COUNT(*) FROM #{reader_function}").first.first
-      source_query_duration = Process.clock_gettime(Process::CLOCK_MONOTONIC) - step_start
+    # @api private
+    def step_count_source
+      source_count = timed(:source_query) { @duckdb.query("SELECT COUNT(*) FROM #{@reader_function}").first.first }
       safe_log(:info, "file_ingestor.count", {
                  source_path: @source_path,
                  count: source_count,
-                 source_query_duration_s: source_query_duration.round(2)
+                 source_query_duration_s: @durations.fetch(:source_query, 0).round(2)
                })
+      source_count
+    end
 
-      if source_count.zero?
-        cleanup_local_file
-        duration = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time
-        safe_log(:info, "file_ingestor.skip_empty", { source_path: @source_path, duration_s: duration.round(2) })
-        return true
-      end
+    # @api private
+    def skip_empty(start_time)
+      cleanup_local_file
+      duration = monotonic - start_time
+      safe_log(:info, "file_ingestor.skip_empty", { source_path: @source_path, duration_s: duration.round(2) })
+      true
+    end
 
-      # 2. Exportación / Subida
+    # @api private
+    def step_export
       @adapter.prepare_export_path(@bucket, @folder_name)
       dest_path = if @config.storage_mode.to_sym == :s3
                     "s3://#{@bucket}/#{@folder_name}/"
                   else
-                    File.join(@bucket,
-                              @folder_name, "")
+                    File.join(@bucket, @folder_name, "")
                   end
 
       partition_clause = @partition_keys.any? ? "PARTITION_BY (#{@partition_keys.join(", ")})," : ""
@@ -82,7 +113,7 @@ module DataDrain
       query = <<~SQL
         COPY (
           SELECT #{@select_sql}
-          FROM #{reader_function}
+          FROM #{@reader_function}
         ) TO '#{dest_path}'
         (
           FORMAT PARQUET,
@@ -93,32 +124,21 @@ module DataDrain
       SQL
 
       safe_log(:info, "file_ingestor.export_start", { dest_path: dest_path })
-      step_start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-      @duckdb.query(query)
-      export_duration = Process.clock_gettime(Process::CLOCK_MONOTONIC) - step_start
+      timed(:export) { @duckdb.query(query) }
+    end
 
-      duration = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time
+    # @api private
+    def log_complete(start_time)
+      duration = monotonic - start_time
       safe_log(:info, "file_ingestor.complete", {
                  source_path: @source_path,
                  duration_s: duration.round(2),
-                 source_query_duration_s: source_query_duration.round(2),
-                 export_duration_s: export_duration.round(2),
-                 count: source_count
+                 source_query_duration_s: @durations.fetch(:source_query, 0).round(2),
+                 export_duration_s: @durations.fetch(:export, 0).round(2),
+                 count: @source_count
                })
-
-      cleanup_local_file
-      true
-    rescue DuckDB::Error => e
-      duration = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time
-      safe_log(:error, "file_ingestor.duckdb_error",
-               { source_path: @source_path }.merge(exception_metadata(e)).merge(duration_s: duration.round(2)))
-      false
-    ensure
-      @duckdb&.close
     end
 
-    private
-
     # @api private
     def determine_reader
       case File.extname(@source_path).downcase
@@ -141,6 +161,4 @@ module DataDrain
       safe_log(:info, "file_ingestor.cleanup", { source_path: @source_path })
     end
   end
-  # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity,
-  #   Metrics/MethodLength
 end

data/lib/data_drain/glue_runner.rb

@@ -14,22 +14,35 @@ module DataDrain
     # @param job_name [String] Nombre del Job en la consola de AWS.
     # @param arguments [Hash] Argumentos de ejecución (deben empezar con --).
     # @param polling_interval [Integer] Segundos de espera entre cada chequeo de estado.
+    # @param max_wait_seconds [Integer, nil] Timeout máximo en segundos.
+    #   nil = sin límite (comportamiento anterior).
     # @return [Boolean] true si el Job terminó exitosamente (SUCCEEDED).
-    # @raise [RuntimeError] Si el Job falla o se detiene.
-    def self.run_and_wait(job_name, arguments = {}, polling_interval: 30)
+    # @raise [DataDrain::Error] si max_wait_seconds excede antes de SUCCEEDED.
+    # @raise [RuntimeError] si el Job falla o se detiene.
+    def self.run_and_wait(job_name, arguments = {}, polling_interval: 30, max_wait_seconds: nil)
       config = DataDrain.configuration
+      config.validate!
       client = Aws::Glue::Client.new(region: config.aws_region)
       start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
 
-      # Usamos el logger de la configuración directamente para el primer log antes de instanciar safe_log si fuera necesario
-      # Pero como extendemos Observability, usamos safe_log directamente.
-      @logger = config.logger 
+      @logger = config.logger
 
       safe_log(:info, "glue_runner.start", { job: job_name })
       resp = client.start_job_run(job_name: job_name, arguments: arguments)
       run_id = resp.job_run_id
 
       loop do
+        if max_wait_seconds &&
+           (Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time) > max_wait_seconds
+          safe_log(:error, "glue_runner.timeout", {
+                     job: job_name,
+                     run_id: run_id,
+                     max_wait_seconds: max_wait_seconds
+                   })
+          raise DataDrain::Error,
+                "Glue Job #{job_name} (Run ID: #{run_id}) excedió max_wait_seconds=#{max_wait_seconds}"
+        end
+
         run_info = client.get_job_run(job_name: job_name, run_id: run_id).job_run
         status = run_info.job_run_state
 
@@ -41,15 +54,14 @@ module DataDrain
         when "FAILED", "STOPPED", "TIMEOUT"
           duration = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time
           error_metadata = { job: job_name, run_id: run_id, status: status, duration_s: duration.round(2) }
-          
-          if run_info.error_message
-            error_metadata[:error_message] = run_info.error_message.gsub("\"", "'")[0, 200]
-          end
+
+          error_metadata[:error_message] = run_info.error_message.gsub("\"", "'")[0, 200] if run_info.error_message
 
           safe_log(:error, "glue_runner.failed", error_metadata)
           raise "Glue Job #{job_name} (Run ID: #{run_id}) falló con estado #{status}."
         else
-          safe_log(:info, "glue_runner.polling", { job: job_name, run_id: run_id, status: status, next_check_in_s: polling_interval })
+          safe_log(:info, "glue_runner.polling",
+                   { job: job_name, run_id: run_id, status: status, next_check_in_s: polling_interval })
           sleep polling_interval
         end
       end

data/lib/data_drain/observability/timing.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module DataDrain
+  module Observability
+    # Helper para medición de duración de operaciones.
+    # @api private
+    module Timing
+      private
+
+      def monotonic
+        Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      end
+
+      def timed(step_name)
+        t = monotonic
+        result = yield
+        @durations ||= {}
+        @durations[step_name] = monotonic - t
+        result
+      end
+    end
+  end
+end

data/lib/data_drain/observability.rb

@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
 module DataDrain
-  # Módulo interno para garantizar que la telemetría cumpla con los 
+  # Módulo interno para garantizar que la telemetría cumpla con los
   # Global-Observability-Standards: resiliencia, KV-structured y precisión.
   #
   # Este módulo es genérico y puede ser utilizado en otras gemas.
   # @api private
   module Observability
+    SENSITIVE_KEY_PATTERN = /password|passwd|pass|secret|token|api_key|apikey|auth|credential|private_key/i
+
     private
 
     # Emite un log estructurado de forma segura.
@@ -19,7 +21,7 @@ module DataDrain
 
       # Enmascaramiento preventivo de secretos (Security)
       log_line = fields.map do |k, v|
-        val = %i[password token secret api_key auth].include?(k.to_sym) ? "[FILTERED]" : v
+        val = SENSITIVE_KEY_PATTERN.match?(k.to_s) ? "[FILTERED]" : v
         "#{k}=#{val}"
       end.join(" ")