Redact PII from logs in an OpenTelemetry Collector pipeline

Steps

1. Add the redactionprocessor to your log pipeline; configure allow_all_keys: false and list only the attribute keys you want to retain in allowed_keys to drop any attribute not on the allowlist
2. Add blocked_values as a list of regular expressions to mask attribute values that match sensitive patterns such as credit card numbers, email addresses, or SSNs; matched portions are replaced with a configurable string (default: ****)
3. For masking inside log body text, add a transformprocessor after the redaction processor with a log_statements OTTL statement: replace_pattern(body, "REGEX", "REDACTED")
4. Order processors: attributes processor first (fast key deletion), then redaction processor (regex value scanning), then transform processor (body manipulation)—this minimises the amount of data subject to regex evaluation
5. Test redaction coverage by emitting synthetic events containing known PII patterns through your local Collector in debug mode and inspecting the output; automate this as a CI check before deploying pipeline changes
6. Document retained fields and masking patterns in a data classification register and review quarterly to catch newly introduced PII fields