Redact Sensitive Data

Detects and redacts sensitive data in logs, metrics, and traces. Matching values are either censored with asterisks or replaced with a hash. Detection is driven by preset rule patterns, custom regex patterns, and key-name controls that target resource attributes, attributes, and log body fields.

Supported Telemetry Types

Metrics	Logs	Traces
✓	✓	✓

Choose Telemetry Type selects which signals a single processor instance redacts. You can enable more than one signal on the same instance.

Configuration

General

Parameter	Type	Required	Default	Description
Choose Telemetry Type	Telemetry Selector	Yes	Logs	The telemetry types to apply redaction rules to. One or more of Logs, Metrics, Traces.
Redaction Strategy	Enum: Censor with Asterisks, Hashing	No	Censor with Asterisks	How matched values are redacted. Censor with Asterisks replaces the value with asterisks. Hashing replaces the value with a hash, which is less performant but preserves uniqueness. Hashing does not fully anonymize data, since hashed values can still be identifiable.
Redaction Rule Presets	Enum (multiple)	No	All presets enabled (see defaults)	Commonly used preset rules to redact. See Default Rule Values for the full list and patterns.
Custom Redaction Rules	List of regex patterns	No	(empty)	A list of regex patterns. Any value that matches a pattern is redacted.
Ignored Values	List of regex patterns	No	(empty)	A list of regex patterns. Values that match are never redacted, regardless of any matching rule.
Redacted Keys	List of regex patterns	No	(empty)	A list of regex patterns matched against key names (resource attributes, attributes, log body fields). The value of any matching key is redacted regardless of its content.
Ignored Keys	List of key names	No	(empty)	A list of exact key names (not regex). The value of any matching key is never redacted.

Advanced

Parameter	Type	Required	Default	Description
Hash Function	Enum: sha3, sha1, md5	No	sha3	Hash algorithm used when Redaction Strategy is Hashing. sha3 is recommended for sensitive data. sha1 and md5 are faster but insecure. Only shown when Redaction Strategy is Hashing.
Added Summary Attributes	Enum: None, Redacted Field Counts, Redacted Field Counts and Names	No	None	Summary attributes added to outgoing telemetry. Redacted Field Counts adds the count of redacted fields. Redacted Field Counts and Names also adds the names of the redacted keys. Has no effect within a SecOps pipeline.
Redact Non-String Data	Boolean	No	true	When enabled, the string representation of non-string values is also evaluated for redaction. When disabled, non-string values pass through unredacted.
Delete All Keys	Boolean	No	false	When enabled, all keys (resource attributes, attributes, and log body fields) are deleted from incoming telemetry, except those in Allowed Keys.
Allowed Keys	List of key names	No	(empty)	A list of exact key names (not regex) that are kept when Delete All Keys is enabled. Only shown when Delete All Keys is enabled.

Default Rule Values

The Redaction Rule Presets parameter maps each selected name to a built-in regex. By default every preset is enabled.

• Credit Card: \b(?:3[47][ -]?\d{4}[ -]?\d{6}[ -]?\d{3}|4\d{3}(?:[ -]?\d{4}){3}|5[1-5]\d{2}(?:[ -]?\d{4}){3}|6(?:011|5\d{2})(?:[ -]?\d{4}){3}|35(?:2[89]|[3-8]\d)(?:[ -]?\d{4}){3}|3(?:0[0-5]|[68]\d)(?:[ -]?\d){11}|62(?:[ -]?\d){14,17})\b
• Date of Birth: \b(?:(?:19|20)?\d{2}[-/])?(?:0?[1-9]|1[0-2])-/(?:-/?\d{2})?\b
• Email: \b[a-zA-Z0-9._/+-—|]+@[A-Za-z0-9-—|]+.[a-zA-Z|]{2,6}\b
• International Bank Account Number (IBAN): \b[A-Z]{2}\d{2}(?: ?[A-Z0-9]){11,31}(?:\s[A-Z0-9])*\b
• IPv4 Address: \b(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9]).){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\b
• IPv6 Address: \b(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b
• MAC Address: \b([0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\b
• US Phone Number: \b((+|\b)[1l][-. ])?(?\b[\dOlZSB]{3,5}([-. ]|) ?)[\dOlZSB]{3}[-. ][\dOlZSB]{4}\b
• International Phone Number: +[1-9]\d{0,2}(?:[-.\s]?(?\d+)?(?:[-.\s]?\d+)*)\b
• Social Security Number (SSN): \b\d{3}[- ]\d{2}[- ]\d{4}\b
• US City, State: \b[A-Z][A-Za-z\s\.]+,\s{0,1}[A-Z]{2}\b
• US Street Address: \b\d+\s[A-z]+\s[A-z]+(\s[A-z]+)?\s*\d*\b
• US Zip Code: \b\d{5}(?:[-\s]\d{4})?\b
• UUID/GUID: \b[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}\b

Examples

Censor common PII in logs with preset rules

Redact a handful of preset patterns in logs by censoring matches with asterisks. This selects three presets rather than the full default set.

apiVersion: bindplane.observiq.com/v1
kind: Processor
metadata:
  name: redact-sensitive-data
spec:
  type: redact_sensitive_data
  parameters:
    - name: telemetry_types
      value:
        - Logs
    - name: redaction_strategy
      value: Censor with Asterisks
    - name: redaction_rules
      value:
        - Social Security Number (SSN)
        - Credit Card
        - Email

Hash custom values and control specific keys

Replace matched values with a sha3 hash instead of asterisks, add custom regex rules, exempt specific values, force redaction of keys by pattern, and exempt specific keys by name. This populates every dynamic list with three rows.

apiVersion: bindplane.observiq.com/v1
kind: Processor
metadata:
  name: redact-sensitive-data
spec:
  type: redact_sensitive_data
  parameters:
    - name: telemetry_types
      value:
        - Logs
        - Traces
    - name: redaction_strategy
      value: Hashing
    - name: hash_function
      value: sha3
    - name: redaction_rules
      value:
        - Email
        - IPv4 Address
        - Credit Card
    - name: custom_rules
      value:
        - ^\d{9}$
        - ^[a-zA-Z]+@[a-zA-Z]+\.com$
        - ^token_[a-zA-Z0-9]{16}$
    - name: ignored_values
      value:
        - ^[a-zA-Z]+@example\.com$
        - ^0\.0\.0\.0$
        - ^token_test[a-zA-Z0-9]{10}$
    - name: redacted_keys
      value:
        - ^service\..*$
        - ^auth\..*$
        - .*password.*
    - name: ignored_keys
      value:
        - service.name
        - service.version
        - host.name
    - name: added_summary_attributes
      value: Redacted Field Counts and Names

In this configuration:

• Redaction Strategy / Hash Function replace matches with a sha3 hash, preserving uniqueness so repeated values remain correlatable while obscured.
• Custom Redaction Rules match nine-digit numbers, lowercase emails ending in .com, and 16-character API tokens.
• Ignored Values keep test emails, the 0.0.0.0 address, and test tokens visible even when they match a rule.
• Redacted Keys always redact values for keys beginning with service., beginning with auth., or containing password, at any level (resource attributes, attributes, log body fields).
• Ignored Keys exempt service.name, service.version, and host.name, which would otherwise be redacted by the ^service\..*$ key pattern.
• Added Summary Attributes adds attributes recording the count and names of redacted fields.

Configuration Tips

• Hashing preserves uniqueness so repeated sensitive values stay correlatable, but it is more CPU-intensive than censoring and does not fully anonymize data. Prefer sha3; sha1 and md5 are faster but cryptographically broken.
• Order of precedence matters. Ignored Values and Ignored Keys take priority over redaction rules and Redacted Keys, so use them to carve out known-safe exceptions rather than loosening your patterns.
• Each custom rule and key pattern is a regex evaluated against every applicable value or key. A broad pattern (for example .*) applied across high-cardinality attributes is expensive. Keep patterns anchored and specific to limit per-record CPU cost.

Troubleshooting

Sensitive values are not being redacted

Symptoms: known sensitive values pass through unmodified.

Solutions:

1. Confirm the relevant preset is selected under Redaction Rule Presets, or add a Custom Redaction Rule whose regex matches the value.
2. Check that the value is not matched by an Ignored Values pattern or that its key is not listed in Ignored Keys, both of which take precedence.
3. If the value is non-string (for example numeric), confirm Redact Non-String Data is enabled.

Too much data is being redacted

Symptoms: non-sensitive values are masked or hashed unexpectedly.

Solutions:

1. A custom rule or Redacted Keys pattern is likely too broad. Anchor the regex (^, $, \b) and narrow the character classes.
2. Add the safe values to Ignored Values or the safe key names to Ignored Keys to exempt them.

Summary attributes are missing in SecOps

Symptoms: Redacted Field Counts attributes do not appear.

Solutions: Added Summary Attributes has no effect within a SecOps pipeline. Verify the pipeline type, or read the counts from a non-SecOps pipeline.

Standalone Processor

apiVersion: bindplane.observiq.com/v1
kind: Processor
metadata:
  name: redact-sensitive-data
spec:
  type: redact_sensitive_data
  parameters:
    - name: telemetry_types
      value:
        - Logs
        - Metrics
        - Traces
    - name: redaction_strategy
      value: Hashing
    - name: hash_function
      value: sha3
    - name: redaction_rules
      value:
        - Email
        - IPv4 Address
        - Credit Card
    - name: custom_rules
      value:
        - ^\d{9}$
        - ^[a-zA-Z]+@[a-zA-Z]+\.com$
        - ^token_[a-zA-Z0-9]{16}$
    - name: ignored_values
      value:
        - ^[a-zA-Z]+@example\.com$
        - ^0\.0\.0\.0$
        - ^token_test[a-zA-Z0-9]{10}$
    - name: redacted_keys
      value:
        - ^service\..*$
        - ^auth\..*$
        - .*password.*
    - name: ignored_keys
      value:
        - service.name
        - service.version
        - host.name
    - name: added_summary_attributes
      value: Redacted Field Counts and Names

Related Resources

• Redaction Processor — OpenTelemetry Collector Contrib
• Mask Sensitive Data
• Delete Fields