Over the years there have been several request to remove events from a recording file, either to reduce the size of the file or to remove sensitive data, such as passwords.

An advanced form of this work would be to remove/replace certain fields, but keep the rest of the event intact. It is not as an important use case and it should work well with primitive objects, so it may make sense to do that portion later, if at all.

More discussion is needed about the design of the API and how the command line tool should work, but this is a first draft to get an idea:

$ jfr scrub [--include <event-names>]
                 [--exclude <event-names>]
                 <input-file> [output-file]

public class RecordingFile {

  /**
   * Writes a filtered version of the recording file to a destination path
   */
  public void copy(Path destination, Predicate<RecordedEvent> filter);
  ...
}

A visitor approach may be considered as it allows greater flexibility in selection, especially in a future advanced version, but may be more cumbersome to use. The API will not just remove the events, but also any constant referenced in the constant pool. This requires reference counting.

When designing the Event Streaming API a filter builder class was consider, for example to filter out all events in a particular thread. The benefit would be that data could be rejected without actually parsing the full event on disk. It could be helpful when scrubbing as well, but it may not be that an important use case.