覆盖 org.apache.log4j.PatternLayout 这个类，改写里面的 format 方法，我这里原来日志里是
<XXX_PASSWD>我是密码</XXX_PASSWD>
，只是改了 return 那句，供参考

/**
Produces a formatted string as specified by the conversion pattern.
*/
public String format(LoggingEvent event) {
// Reset working stringbuffer
if(sbuf.capacity() > MAX_CAPACITY) {
sbuf = new StringBuffer(BUF_SIZE);
} else {
sbuf.setLength(0);
}

PatternConverter c = head;

while(c != null) {
c.format(sbuf, event);
c = c.next;
}

return sbuf.toString().replaceAll("PASSWD>[^<]*</", "PASSWD>***</");
}