I use for logging Log4J

my appender config

<RollingFile name="FILE-LOGSTASH"
             fileName="C:Usersp.bohomazIdeaProjectso2-lcmlog4j-logstash.log"
             filePattern="C:Usersp.bohomazIdeaProjectso2-lcmlog4j-logstash-%d{yyyy-MM-dd-HH}.log.gz">
    <LogStashJsonLayout/>
    <Policies>
        <TimeBasedTriggeringPolicy interval="1" modulate="true"/>
    </Policies>
</RollingFile>

my problem that sometimes in the log I receive plain phone number
and I want to replace it to 3********9

I found that LogStashJsonLayout is deprecated and haven’t this option and I need to use
JsonTemplateLayout

so I changed my configuration to this one

<RollingFile name="FILE-LOGSTASH"
             fileName="C:Usersp.bohomazIdeaProjectso2-lcmlog4j-logstash.log"
             filePattern="C:Usersp.bohomazIdeaProjectso2-lcmlog4j-logstash-%d{yyyy-MM-dd-HH}.log.gz">
    <JsonTemplateLayout eventTemplateUri="classpath:EcsLayout.json"/>

    <Policies>
        <TimeBasedTriggeringPolicy interval="1" modulate="true"/>
    </Policies>
</RollingFile>

and my json template file

{
“@version”: “1”,
“@timestamp”: {
“$resolver”: “timestamp”,
“pattern”: {
“format”: “yyyy-MM-dd’T’HH:mm:ss.SSS’Z'”,
“timeZone”: “UTC”
}
},
“logger”: {
“$resolver”: “logger”,
“field”: “name”
},
“priority”: {
“$resolver”: “level”,
“field”: “name”
},
“thread”: {
“$resolver”: “thread”,
“field”: “name”
},
“message”: {
“$resolver”: “message”,
“replace”: {
“regex”: “(d{2})(d{7,11})(d{2})”,
“replacement”: “$1********$3”
}
}
}

But I still see plain number in the logs
I checked documentation and there I see that I need to use pattern.replace(regex,replacement)
but it also doesn’t work
so could someone help with it.
Is it possible to do it in template or do I need to create filter for it?