Docs » Get started with the Splunk Distribution of the OpenTelemetry Collector » Collector components » Collector components: Processors » Attributes processor

Attributes processor 🔗

The attributes processor is an OpenTelemetry Collector component that modifies the attributes of spans, metrics, or logs through actions. You can combine actions in a single processor instance to run complex operations. Use cases include, among others, obfuscating sensitive information, copying values to new keys, and backfilling attributes.

You can apply any of the following actions on collected attributes of spans, metrics, or logs:

Action

Description

insert

Inserts a new attribute in data lacking a specific key, which must have either a value, from_attribute, or from_context defined.

update

Updates an attribute in data that has a specific key, which must have either a value, from_attribute, or from_context defined.

upsert

Updates or insert an attribute in data depending on whether a key exists or not. The key must have either a value, from_attribute, or from_context defined.

delete

Deletes an attribute from the data that has a specific key or pattern.

hash

Hashes the value of an existing attribute that has a specific key or pattern using the SHA1 algorithm.

extract

Extracts values using regular expression rules. A pattern is required.

convert

Converts an attribute to another type, as specified in the converted_type parameter, which can be either int, double, or string.

Note

Use the Metrics transform processor to rename metrics, or add, rename or delete label keys and values. You can also use it to perform scaling and aggregations on metrics across labels or label values. See Metrics transform processor.

To include or exclude whole spans, logs, or metrics, use the filter processor. See Filter processor.

Get started 🔗

By default, the Splunk Distribution of OpenTelemetry Collector includes the attributes processor. To activate the attributes processor for a pipeline, add attributes to the processors section of the configuration. For example:

processors:
  attributes/example:
    actions:
      - key: db.table
        action: delete
      - key: redacted_span
        value: "new_value"
        action: upsert
      - key: copy_key
        from_attribute: key_original
        action: update
      - key: account_id
        value: 33445
        action: insert
      - key: account_password
        action: delete
      - key: account_email
        action: hash
      - key: http.status_code
        action: convert
        converted_type: int

You can then add the attributes processors to any compatible pipeline. For example:

service:
  pipelines:
    traces:
      receivers: [jaeger, otlp, zipkin]
      processors:
      - attributes/traces
      - memory_limiter
      - batch
      - resourcedetection
      exporters: [sapm, signalfx]
    metrics:
      receivers: [hostmetrics, otlp, signalfx]
      processors:
      - attributes/metrics
      - memory_limiter
      - batch
      - resourcedetection
      exporters: [signalfx]
    logs:
      receivers: [fluentforward, otlp]
      processors:
      - attributes/logs
      - memory_limiter
      - batch
      - resourcedetection
      exporters: [splunk_hec]

To include or exclude attributes use any of the following properties:

  • services

  • resources

  • libraries

  • span_names

  • log_bodies

  • log_severity_texts

  • metric_names

  • attributes

The following example shows how to apply a delete action to specific services:

attributes/selectiveprocessing:
  include:
    match_type: strict
    services: ["service1", "service2"]
  actions:
    - key: sensitive_field
      action: delete

For a complete list of parameters, see Settings.

Sample configurations 🔗

The following sample configurations show how to perform different actions on attributes.

Note

For a complete list of examples, see the configuration snippets in https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/processor/attributesprocessor/testdata/config.yaml.

Remove or obfuscate sensitive information from logs 🔗

The following example shows how to remove a token attribute, hash an email, and redact a password in logs:

attributes/log_body_regexp:
  include:
    match_type: regexp
      log_bodies: ["AUTH.*"]
    actions:
      - key: password
        action: update
        value: "Redacted"
      - key: apitoken
        action: delete
      - key: email
        action: hash

Create a new attribute based on the value of another 🔗

The following example shows how to create a new attribute based on the value of another attribute in spans:

attributes/createattributes:
  actions:
      # Creates four new attributes (defined in pattern) from the
      # value of the http.url attribute
    - key: "http.url"
        pattern: ^(?P<http_protocol>.*):\\/\\/(?P<http_domain>.*)\\/(?P<http_path>.*)(\\?|\\&)(?P<http_query_params>.*)
        action: extract

Backfill spans that are missing an attribute 🔗

The following example shows how to backfill spans that are missing an attribute:

attributes/complex:
  actions:
    - key: operation
      value: default
      action: insert
    - key: svc.operation
      from_attribute: operation
      action: upsert
    - key: operation
      action: delete

More examples and scenarios 🔗

See also the following scenarios:

Settings 🔗

The following table shows the configuration options for the attributes processor:

Troubleshooting 🔗

If you are a Splunk Observability Cloud customer and are not able to see your data in Splunk Observability Cloud, you can get help in the following ways.

Available to Splunk Observability Cloud customers

Available to prospective customers and free trial users

  • Ask a question and get answers through community support at Splunk Answers .

  • Join the Splunk #observability user group Slack channel to communicate with customers, partners, and Splunk employees worldwide. To join, see Chat groups in the Get Started with Splunk Community manual.

To learn about even more support options, see Splunk Customer Success .