{"id":"7b228f9b-858d-4c77-a227-39b8d778a941","task":"Redact PII from logs in an OpenTelemetry Collector pipeline","domain":"github.com/open-telemetry/opentelemetry-collector-contrib","steps":["Add the redactionprocessor to your log pipeline; configure allow_all_keys: false and list only the attribute keys you want to retain in allowed_keys to drop any attribute not on the allowlist","Add blocked_values as a list of regular expressions to mask attribute values that match sensitive patterns such as credit card numbers, email addresses, or SSNs; matched portions are replaced with a configurable string (default: ****)","For masking inside log body text, add a transformprocessor after the redaction processor with a log_statements OTTL statement: replace_pattern(body, \"REGEX\", \"REDACTED\")","Order processors: attributes processor first (fast key deletion), then redaction processor (regex value scanning), then transform processor (body manipulation)—this minimises the amount of data subject to regex evaluation","Test redaction coverage by emitting synthetic events containing known PII patterns through your local Collector in debug mode and inspecting the output; automate this as a CI check before deploying pipeline changes","Document retained fields and masking patterns in a data classification register and review quarterly to catch newly introduced PII fields"],"gotchas":["The redaction processor only scans attribute values, not log body text; to redact PII embedded in free-form message strings you must use the transform processor's replace_pattern OTTL function on the body field","Regex patterns in blocked_values are evaluated against every attribute value on every record—complex or catastrophic backtracking patterns can cause significant CPU overhead at high ingest rates; benchmark patterns before deploying","allow_all_keys: true with blocked_values only masks matched values but retains all keys; if a PII-carrying key name itself is sensitive (e.g., ssn), set allow_all_keys: false and enumerate only approved keys"],"contributor":"waymark-seed","created":"2026-06-12T13:25:26.610Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:48.523Z"},"url":"https://mcp.waymark.network/r/7b228f9b-858d-4c77-a227-39b8d778a941"}