Attributes processor 🔗
The attributes processor is an OpenTelemetry Collector component that modifies the attributes of spans, metrics, or logs through actions. You can combine actions in a single processor instance to run complex operations. Use cases include, among others, obfuscating sensitive information, copying values to new keys, and backfilling attributes.
You can apply any of the following actions on collected attributes of spans, metrics, or logs:
Inserts a new attribute in data lacking a specific
Updates an attribute in data that has a specific
Updates or insert an attribute in data depending on whether a
Deletes an attribute from the data that has a specific
Hashes the value of an existing attribute that has a specific
Extracts values using regular expression rules. A
Converts an attribute to another type, as specified in the
To include or exclude whole spans, logs, or metrics, use the filter processor. See Filter processor.
Get started 🔗
By default, the Splunk Distribution of OpenTelemetry Collector includes the attributes processor. To activate the attributes processor for a pipeline, add
attributes to the
processors section of the configuration. For example:
processors: attributes/example: actions: - key: db.table action: delete - key: redacted_span value: "new_value" action: upsert - key: copy_key from_attribute: key_original action: update - key: account_id value: 33445 action: insert - key: account_password action: delete - key: account_email action: hash - key: http.status_code action: convert converted_type: int
You can then add the attributes processors to any compatible pipeline. For example:
service: pipelines: traces: receivers: [jaeger, otlp, smartagent/signalfx-forwarder, zipkin] processors: - attributes/traces - memory_limiter - batch - resourcedetection exporters: [sapm, signalfx] metrics: receivers: [hostmetrics, otlp, signalfx, smartagent/signalfx-forwarder] processors: - attributes/metrics - memory_limiter - batch - resourcedetection exporters: [signalfx] logs: receivers: [fluentforward, otlp] processors: - attributes/logs - memory_limiter - batch - resourcedetection exporters: [splunk_hec]
To include or exclude attributes use any of the following properties:
The following example shows how to apply a
delete action to specific services:
attributes/selectiveprocessing: include: match_type: strict services: ["service1", "service2"] actions: - key: sensitive_field action: delete
For a complete list of parameters, see Settings.
Sample configurations 🔗
The following sample configurations show how to perform different actions on attributes.
For a complete list of examples, see the configuration snippets in https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/processor/attributesprocessor/testdata/config.yaml.
Remove or obfuscate sensitive information from logs 🔗
The following example shows how to remove a token attribute, hash an email, and redact a password in logs:
attributes/log_body_regexp: include: match_type: regexp log_bodies: ["AUTH.*"] actions: - key: password action: update value: "Redacted" - key: apitoken action: delete - key: email action: hash
Create a new attribute based on the value of another 🔗
The following example shows how to create a new attribute based on the value of another attribute in spans:
attributes/createattributes: actions: # Creates four new attributes (defined in pattern) from the # value of the http.url attribute - key: "http.url" pattern: ^(?P<http_protocol>.*):\/\/(?P<http_domain>.*)\/(?P<http_path>.*)(\?|\&)(?P<http_query_params>.*) action: extract
Backfill spans that are missing an attribute 🔗
The following example shows how to backfill spans that are missing an attribute:
attributes/complex: actions: - key: operation value: default action: insert - key: svc.operation from_attribute: operation action: upsert - key: operation action: delete
More examples and use cases 🔗
See also the following use cases:
The following table shows the configuration options for the attributes processor:
If you are a Splunk Observability Cloud customer and are not able to see your data in Splunk Observability Cloud, you can get help in the following ways.
Available to Splunk Observability Cloud customers 🔗
Submit a case in the Splunk Support Portal.
Call Splunk Customer Support.
Available to customers and free trial users 🔗
Ask a question and get answers through community support at Splunk Answers.
Join the Splunk #observability user group Slack channel to communicate with customers, partners, and Splunk employees worldwide. To join, see Chat groups in the Get Started with Splunk Community manual.
To learn about even more support options, see Splunk Customer Success.