> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/integrations/processors/redact-sensitive-data.md). # Redact Sensitive Data Detects and redacts sensitive data in logs, metrics, and traces. Matching values are either censored with asterisks or replaced with a hash. Detection is driven by preset rule patterns, custom regex patterns, and key-name controls that target resource attributes, attributes, and log body fields. ### Supported Telemetry | Metrics | Logs | Traces | | ------- | ---- | ------ | | ✓ | ✓ | ✓ | Choose Telemetry Type selects which signals a single processor instance redacts. You can enable more than one signal on the same instance. ### Configuration
Bindplane docs - Redact Sensitive Data - image 1
**General** | Parameter | Type | Required | Default | Description | | ---------------------- | ------------------------------------ | -------- | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Choose Telemetry Type | Telemetry Selector | Yes | `Logs` | The telemetry types to apply redaction rules to. One or more of Logs, Metrics, Traces. | | Redaction Strategy | Enum: Censor with Asterisks, Hashing | No | `Censor with Asterisks` | How matched values are redacted. `Censor with Asterisks` replaces the value with asterisks. `Hashing` replaces the value with a hash, which is less performant but preserves uniqueness. Hashing does not fully anonymize data, since hashed values can still be identifiable. | | Redaction Rule Presets | Enum (multiple) | No | All presets enabled (see [defaults](#default-rules-values)) | Commonly used preset rules to redact. See [Default Rule Values](#default-rules-values) for the full list and patterns. | | Custom Redaction Rules | List of regex patterns | No | *(empty)* | A list of regex patterns. Any value that matches a pattern is redacted. | | Ignored Values | List of regex patterns | No | *(empty)* | A list of regex patterns. Values that match are never redacted, regardless of any matching rule. | | Redacted Keys | List of regex patterns | No | *(empty)* | A list of regex patterns matched against key names (resource attributes, attributes, log body fields). The value of any matching key is redacted regardless of its content. | | Ignored Keys | List of key names | No | *(empty)* | A list of exact key names (not regex). The value of any matching key is never redacted. | **Advanced** | Parameter | Type | Required | Default | Description | | ------------------------ | ------------------------------------------------------------------ | -------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Hash Function | Enum: sha3, sha1, md5 | No | `sha3` | Hash algorithm used when Redaction Strategy is `Hashing`. `sha3` is recommended for sensitive data. `sha1` and `md5` are faster but insecure. Only shown when Redaction Strategy is `Hashing`. | | Added Summary Attributes | Enum: None, Redacted Field Counts, Redacted Field Counts and Names | No | `None` | Summary attributes added to outgoing telemetry. `Redacted Field Counts` adds the count of redacted fields. `Redacted Field Counts and Names` also adds the names of the redacted keys. Has no effect within a SecOps pipeline. | | Redact Non-String Data | Boolean | No | `true` | When enabled, the string representation of non-string values is also evaluated for redaction. When disabled, non-string values pass through unredacted. | | Delete All Keys | Boolean | No | `false` | When enabled, all keys (resource attributes, attributes, and log body fields) are deleted from incoming telemetry, except those in Allowed Keys. | | Allowed Keys | List of key names | No | *(empty)* | A list of exact key names (not regex) that are kept when Delete All Keys is enabled. Only shown when Delete All Keys is enabled. | **Default Rule Values** The Redaction Rule Presets parameter maps each selected name to a built-in regex. By default every preset is enabled. * Credit Card: `\b(?:3[47][ -]?\d{4}[ -]?\d{6}[ -]?\d{3}|4\d{3}(?:[ -]?\d{4}){3}|5[1-5]\d{2}(?:[ -]?\d{4}){3}|6(?:011|5\d{2})(?:[ -]?\d{4}){3}|35(?:2[89]|[3-8]\d)(?:[ -]?\d{4}){3}|3(?:0[0-5]|[68]\d)(?:[ -]?\d){11}|62(?:[ -]?\d){14,17})\b` * Date of Birth: `\b(?:(?:19|20)?\d{2}[-/])?(?:0?[1-9]|1[0-2])-/(?:-/?\d{2})?\b` * Email: `\b[a-zA-Z0-9._/+-—|]+@[A-Za-z0-9-—|]+.[a-zA-Z|]{2,6}\b` * International Bank Account Number (IBAN): `\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]){11,31}(?:\s[A-Z0-9])*\b` * IPv4 Address: `\b(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9]).){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\b` * IPv6 Address: `\b(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b` * MAC Address: `\b([0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\b` * US Phone Number: `\b((+|\b)[1l][-. ])?(?\b[\dOlZSB]{3,5}([-. ]|) ?)[\dOlZSB]{3}[-. ][\dOlZSB]{4}\b` * International Phone Number: `+[1-9]\d{0,2}(?:[-.\s]?(?\d+)?(?:[-.\s]?\d+)*)\b` * Social Security Number (SSN): `\b\d{3}[- ]\d{2}[- ]\d{4}\b` * US City, State: `\b[A-Z][A-Za-z\s\.]+,\s{0,1}[A-Z]{2}\b` * US Street Address: `\b\d+\s[A-z]+\s[A-z]+(\s[A-z]+)?\s*\d*\b` * US Zip Code: `\b\d{5}(?:[-\s]\d{4})?\b` * UUID/GUID: `\b[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}\b` ### Examples #### Censor common PII in logs with preset rules Redact a handful of preset patterns in logs by censoring matches with asterisks. This selects three presets rather than the full default set. ```yaml apiVersion: bindplane.observiq.com/v1 kind: Processor metadata: name: redact-sensitive-data spec: type: redact_sensitive_data parameters: - name: telemetry_types value: - Logs - name: redaction_strategy value: Censor with Asterisks - name: redaction_rules value: - Social Security Number (SSN) - Credit Card - Email ``` #### Hash custom values and control specific keys Replace matched values with a `sha3` hash instead of asterisks, add custom regex rules, exempt specific values, force redaction of keys by pattern, and exempt specific keys by name. This populates every dynamic list with three rows. ```yaml apiVersion: bindplane.observiq.com/v1 kind: Processor metadata: name: redact-sensitive-data spec: type: redact_sensitive_data parameters: - name: telemetry_types value: - Logs - Traces - name: redaction_strategy value: Hashing - name: hash_function value: sha3 - name: redaction_rules value: - Email - IPv4 Address - Credit Card - name: custom_rules value: - ^\d{9}$ - ^[a-zA-Z]+@[a-zA-Z]+\.com$ - ^token_[a-zA-Z0-9]{16}$ - name: ignored_values value: - ^[a-zA-Z]+@example\.com$ - ^0\.0\.0\.0$ - ^token_test[a-zA-Z0-9]{10}$ - name: redacted_keys value: - ^service\..*$ - ^auth\..*$ - .*password.* - name: ignored_keys value: - service.name - service.version - host.name - name: added_summary_attributes value: Redacted Field Counts and Names ``` In this configuration: * **Redaction Strategy / Hash Function** replace matches with a `sha3` hash, preserving uniqueness so repeated values remain correlatable while obscured. * **Custom Redaction Rules** match nine-digit numbers, lowercase emails ending in `.com`, and 16-character API tokens. * **Ignored Values** keep test emails, the `0.0.0.0` address, and test tokens visible even when they match a rule. * **Redacted Keys** always redact values for keys beginning with `service.`, beginning with `auth.`, or containing `password`, at any level (resource attributes, attributes, log body fields). * **Ignored Keys** exempt `service.name`, `service.version`, and `host.name`, which would otherwise be redacted by the `^service\..*$` key pattern. * **Added Summary Attributes** adds attributes recording the count and names of redacted fields. ### Configuration Tips * Hashing preserves uniqueness so repeated sensitive values stay correlatable, but it is more CPU-intensive than censoring and does not fully anonymize data. Prefer `sha3`; `sha1` and `md5` are faster but cryptographically broken. * Order of precedence matters. Ignored Values and Ignored Keys take priority over redaction rules and Redacted Keys, so use them to carve out known-safe exceptions rather than loosening your patterns. * Each custom rule and key pattern is a regex evaluated against every applicable value or key. A broad pattern (for example `.*`) applied across high-cardinality attributes is expensive. Keep patterns anchored and specific to limit per-record CPU cost. ### Troubleshooting #### Sensitive values are not being redacted Symptoms: known sensitive values pass through unmodified. Solutions: 1. Confirm the relevant preset is selected under Redaction Rule Presets, or add a Custom Redaction Rule whose regex matches the value. 2. Check that the value is not matched by an Ignored Values pattern or that its key is not listed in Ignored Keys, both of which take precedence. 3. If the value is non-string (for example numeric), confirm Redact Non-String Data is enabled. #### Too much data is being redacted Symptoms: non-sensitive values are masked or hashed unexpectedly. Solutions: 1. A custom rule or Redacted Keys pattern is likely too broad. Anchor the regex (`^`, `$`, `\b`) and narrow the character classes. 2. Add the safe values to Ignored Values or the safe key names to Ignored Keys to exempt them. #### Summary attributes are missing in SecOps Symptoms: Redacted Field Counts attributes do not appear. Solutions: Added Summary Attributes has no effect within a SecOps pipeline. Verify the pipeline type, or read the counts from a non-SecOps pipeline. ### Standalone Processor ```yaml apiVersion: bindplane.observiq.com/v1 kind: Processor metadata: name: redact-sensitive-data spec: type: redact_sensitive_data parameters: - name: telemetry_types value: - Logs - Metrics - Traces - name: redaction_strategy value: Hashing - name: hash_function value: sha3 - name: redaction_rules value: - Email - IPv4 Address - Credit Card - name: custom_rules value: - ^\d{9}$ - ^[a-zA-Z]+@[a-zA-Z]+\.com$ - ^token_[a-zA-Z0-9]{16}$ - name: ignored_values value: - ^[a-zA-Z]+@example\.com$ - ^0\.0\.0\.0$ - ^token_test[a-zA-Z0-9]{10}$ - name: redacted_keys value: - ^service\..*$ - ^auth\..*$ - .*password.* - name: ignored_keys value: - service.name - service.version - host.name - name: added_summary_attributes value: Redacted Field Counts and Names ``` ### Related Resources * [Redaction Processor — OpenTelemetry Collector Contrib](https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/processor/redactionprocessor/README.md) * [Mask Sensitive Data](https://github.com/observIQ/bindplane-docs/blob/main/docs/integrations/processors/mask-sensitive-data.md) * [Delete Fields](/integrations/processors/delete-fields.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.bindplane.com/integrations/processors/redact-sensitive-data.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.