Traces Pipeline Examples

We strongly advise reading the intro guide to working with remap transforms in order to fully understand the functionalities of writing pipelines steps.

Filtering out specific resources

The following example will filter out all HTTP traces that include the /health URI. Note that the filter transform works by setting up an allow condition - meaning, events which fail the condition will be dropped.

The filter below implements this logic:

1. If the event isn't an HTTP event, allow it

2. If the event is an HTTP event, and the resource name doesn't contain "/health", allow it

3. If the event is an HTTP event AND it has "/health" in the resource name, drop it

We are using the abort error handling below when calling the string function. If the protocol type or resource name aren't valid strings, we drop the event.

vector:
  tracesPipeline:
    extraSteps: 
    - name: filterHealthAPIs
      transform:
        type: filter
        condition: |-
          string!(.protocol_type) != "http" || !contains(string!(.resource_name), "/health")

Redact payloads from a specific server

The following example will obfuscate response payloads from a specific server. This can be useful when you want to completely redact responses that contain sensitive data, such as secrets managed by an external server.

vector:
  tracesPipeline:
    extraSteps: 
    - name: obfuscateSecretServerResponses
      transform:
        type: remap
        source: |-
          if exists(.server) && string!(.server) == "my-secret-server" {
            .response_body = "<REDACTED>"
            .response_body_truncated = true
          }

Redact payloads based on a header value

In this example we redact HTTP payloads for any request containing the host: frontend header.

vector:
  tracesPipeline:
    extraSteps: 
    - name: obfuscateBasedOnHeader
      transform:
        type: remap
        source: |-
          if exists(.http_request_headers.host) && string!(.http_request_headers.host) == "frontend" {
            .request_body = "<REDACTED>"
            .response_body = "<REDACTED>"
          }