This is documentation for the next version of Grafana Alloy Documentation. For the latest stable release, go to the latest version.

Documentation Grafana Alloy Reference Components otelcol otelcol.processor.redaction

otelcol.processor.redaction

otelcol.processor.redaction removes span, log, and metric attributes that don’t match an allowlist. It masks attribute values that match blocklist expressions and sanitizes high-cardinality URLs and database queries into stable, low-cardinality forms. It also removes disallowed keys from map-shaped log bodies and masks or sanitizes values in log bodies.

You can specify multiple otelcol.processor.redaction components by giving them different labels.

Usage

Alloy Copy

otelcol.processor.redaction "<LABEL>" {
  allowed_keys  = ["<KEY>", ...]
  blocked_values = ["<REGEX>", ...]

  output {
    metrics = [...]
    logs    = [...]
    traces  = [...]
  }
}

Arguments

You can use the following arguments with otelcol.processor.redaction:

If allow_all_keys is false, only attributes whose keys appear in allowed_keys are kept. The allowed_keys list fails closed: if it’s empty and allow_all_keys is false, all attributes are removed.

The processor removes disallowed keys before it checks remaining values against blocked_values. To mask values without removing keys, set allow_all_keys = true or include the keys in allowed_keys.

hash_function accepts one of sha1, sha3, md5, hmac-sha256, or hmac-sha512, and the value is case-insensitive. Alloy validates hash_function during configuration parsing. When you set hash_function to hmac-sha256, you must also set hmac_key to at least 32 bytes. When you set hash_function to hmac-sha512, you must also set hmac_key to at least 64 bytes.

The processor matches each blocked_values expression against attribute values. It replaces only the substring that matches the expression. By default, the processor replaces matching text with ****. When you set hash_function, the processor replaces matching text with a hash of the matched substring. Regular expressions use the RE2 syntax, which doesn’t support lookarounds or backreferences.

Blocks

You can use the following blocks with otelcol.processor.redaction:

output

url_sanitizer

The url_sanitizer block sanitizes high-cardinality URLs, such as routes with embedded IDs or query strings, into stable low-cardinality forms. This helps prevent span-metrics cardinality explosions. By default, it also sanitizes matching client and server span names.

db_sanitizer

The db_sanitizer block sanitizes database queries and commands. By default, it also sanitizes matching client, server, and internal span names.

The db_sanitizer block contains the es, memcached, mongo, opensearch, redis, sql, and valkey blocks described in db blocks.

db blocks

The es, memcached, mongo, opensearch, redis, sql, and valkey blocks each configure sanitization for one database technology. All of them share the same arguments:

debug_metrics

Exported fields

The following fields are exported and can be referenced by other components:

input accepts otelcol.Consumer data for any telemetry signal (metrics, logs, or traces).

Component health

otelcol.processor.redaction is only reported as unhealthy if given an invalid configuration.

Debug information

otelcol.processor.redaction doesn’t expose any component-specific debug information.

Debug metrics

otelcol.processor.redaction doesn’t expose any component-specific debug metrics.

Examples

Keep selected keys and mask credit card numbers

This example keeps only an explicit set of attribute keys and masks any value that looks like a credit card number.

Alloy Copy

otelcol.processor.redaction "default" {
  allowed_keys   = ["description", "group", "id", "name"]
  blocked_values = ["4[0-9]{12}(?:[0-9]{3})?"]

  output {
    traces = [otelcol.exporter.otlp.default.input]
  }
}

Sanitize high-cardinality URLs

This example collapses high-cardinality URLs and span names into stable low-cardinality forms.

Alloy Copy

otelcol.processor.redaction "default" {
  allow_all_keys = true

  url_sanitizer {
    enabled            = true
    attributes         = ["http.url", "url.full"]
    sanitize_span_name = true
  }

  output {
    traces = [otelcol.exporter.otlp.default.input]
  }
}

Redact IP addresses

This example masks IPv4 and IPv6 addresses found in any attribute value. Each regular expression matches a full address, so the whole address is replaced with ****. The regular expressions are written as raw strings using backticks, so backslashes don’t need to be escaped.

Alloy Copy

otelcol.processor.redaction "default" {
  allow_all_keys = true

  blocked_values = [
    // IPv4, for example 203.0.113.42
    `\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b`,
    // IPv6, including the "::" compressed forms, for example 2001:db8::1
    `(?i)(?:[0-9a-f]{1,4}:){7}[0-9a-f]{1,4}|(?:[0-9a-f]{1,4}:){1,2}(?::[0-9a-f]{1,4}){1,5}|(?:[0-9a-f]{1,4}:){1,3}(?::[0-9a-f]{1,4}){1,4}|(?:[0-9a-f]{1,4}:){1,4}(?::[0-9a-f]{1,4}){1,3}|(?:[0-9a-f]{1,4}:){1,5}(?::[0-9a-f]{1,4}){1,2}|(?:[0-9a-f]{1,4}:){1,6}:[0-9a-f]{1,4}|(?:[0-9a-f]{1,4}:){1,7}:|:(?::[0-9a-f]{1,4}){1,7}|::`,
  ]

  output {
    traces = [otelcol.exporter.otlp.default.input]
  }
}

Redact email addresses

This example masks any email address found in an attribute value, so john.doe@example.com becomes ****.

Alloy Copy

otelcol.processor.redaction "default" {
  allow_all_keys = true

  blocked_values = [
    `[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}`,
  ]

  output {
    traces = [otelcol.exporter.otlp.default.input]
  }
}

Hash matched values

Setting hash_function replaces each matched value with a hash instead of a fixed **** string. Identical inputs produce identical hashes, so you can still correlate telemetry by a value, such as a client IP, without exposing it. This example replaces IPv4 addresses with a keyed HMAC-SHA256 digest.

Alloy Copy

otelcol.processor.redaction "default" {
  allow_all_keys = true

  hash_function = "hmac-sha256"
  hmac_key      = sys.env("REDACTION_HMAC_KEY") // must be at least 32 bytes

  blocked_values = [
    `\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b`,
  ]

  output {
    traces = [otelcol.exporter.otlp.default.input]
  }
}

Compatible components

otelcol.processor.redaction can accept arguments from the following components:

• Components that export OpenTelemetry otelcol.Consumer

otelcol.processor.redaction has exports that can be consumed by the following components:

• Components that consume OpenTelemetry otelcol.Consumer