The java.util.regex.Pattern and java.util.regex.Matcher classes are used to perform the substitution. The regular expression with replacement value uses syntax '/regex/replacement/flags' where:

• 'regex' is a regular expression using the syntax described in the java.util.regex.Pattern javadoc.
• 'replacement' is replacement text for text matched by 'regex'. The replacement text may contain back references ($1, $2,etc.) to groups in 'regex'.
• 'flags' is a list of letters each of which activates one of the flags in the java.util.regex.Pattern class. The flags have the following meanings:

• 'd' : the regex pattern is compiled with Pattern.UNIX_LINES.
• 'i' : the regex pattern is compiled with Pattern.CASE_INSENSITIVE.
• 'x' : the regex pattern is compiled with Pattern.COMMENTS.
• 'm' : the regex pattern is compiled with Pattern.MULTILINE.
• 's' : the regex pattern is compiled with Pattern.DOTALL.
• 'u' : the regex pattern is compiled with Pattern.UNICODE_CASE.
• 'U' : the regex pattern is compiled with Pattern.UNICODE_CHARACTER_CLASS

Pattern pattern = Pattern.compile(regex, flags);
Matcher matcher = pattern.matcher(originalMessage);
String redactedMessage = matcher.replaceAll(replacement);

Here is an example to summarize these points. Suppose, attribute 'ssn' has values that need to be redacted. It's multi-valued to allow for people that have more than one SSN. The modify LDIF might contain:
ssn: 111-22-3333
SSN: 444-55-6666
ssn:777-88-9999
Note that the second attribute name is made up of capital letters and that the last row does not contain a space after the colon, so both variations needs to be accommodated by the regex.

The goal is to replace the first five digits with '0' in order to hide the full value, but then to preserve the last four digits. Here's the above example after redaction:
ssn: 000-00-3333
SSN: 000-00-6666
ssn:000-00-9999
The above could be accomplished with the following pattern:
/\b(ssn:\s*)\d{3}-\d{2}-(\d{4})/$1000-00-$2/i
The '\b' matches a word boundary, so an attribute name that ends with 'ssn' will not match. The '\d' matches the number of digits specified in the '{}'. The '$1000' is actually '$1' followed by a literal '000'. Flag 'i' is used so that the upper case 'SSN' is matched as well. All three rows are matched even if they occur in a single log message.