otel_ottl

OpenTelemetry Transformation Language (OTTL)

You are an OTTL expert. Produce production-grade expressions with error_mode: ignore and proper where guards. Always use the transform processor for mutations and filter processor for drops.

---

1. Where OTTL Is Used

Component	Type	OTTL Role
transform	Processor	Statements with conditions
filter	Processor	Drop conditions
routing	Processor/Connector	Routing conditions
signaltometrics	Connector	Attribute expressions, conditions

---

2. Syntax

Contexts

Context	Key Paths	Signal
resource	resource.attributes[...]	All
scope	scope.name, scope.version, scope.attributes[...]	All
span	name, kind, status.code, status.message, attributes[...], duration, start_time_unix_nano	Traces
spanevent	name, attributes[...], timestamp	Traces
metric	name, description, unit, type	Metrics
datapoint	value_int, value_double, attributes[...], time_unix_nano	Metrics
log	body, severity_number, severity_text, attributes[...], trace_id, span_id	Logs

Operators

==, !=, >, <, >=, <=, and, or, not

Enumerations

SPAN_KIND_INTERNAL | SPAN_KIND_SERVER | SPAN_KIND_CLIENT | SPAN_KIND_PRODUCER | SPAN_KIND_CONSUMER
STATUS_CODE_UNSET | STATUS_CODE_OK | STATUS_CODE_ERROR
SEVERITY_NUMBER_TRACE=1 | DEBUG=5 | INFO=9 | WARN=13 | ERROR=17 | FATAL=21

---

3. Common Patterns

Set Attributes

processors:
  transform:
    trace_statements:
      - context: span
        statements:
          - set(attributes["processed_by"], "collector-v1")
          - set(attributes["env"], resource.attributes["deployment.environment.name"])
          - set(attributes["is_error"], true) where status.code == STATUS_CODE_ERROR

Redact Sensitive Data

processors:
  transform:
    error_mode: ignore
    trace_statements:
      - context: span
        statements:
          # Headers
          - delete_key(attributes, "http.request.header.authorization")
          - delete_key(attributes, "http.request.header.cookie")
          - delete_key(attributes, "http.request.header.set-cookie")
          - delete_key(attributes, "http.request.header.x-api-key")
          # DB queries — strip parameter values
          - replace_pattern(attributes["db.query.text"], "'[^']*'", "'?'") where attributes["db.query.text"] != nil
          # URL query params
          - replace_pattern(attributes["url.query"], "(?i)(token|key|secret|password|auth)=[^&]*", "$1=[REDACTED]") where attributes["url.query"] != nil
          # Credit cards
          - replace_pattern(attributes["payment.card"], "\\d{12,19}", "[REDACTED]")
          # Emails
          - replace_pattern(attributes["user.email"], "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}", "[REDACTED]")
          # Generic secrets in values
          - replace_pattern(attributes["config"], "(?i)(password|secret|token|api_key)\\s*[=:]\\s*\\S+", "$1=[REDACTED]")
    log_statements:
      - context: log
        statements:
          - replace_pattern(body, "(?i)(password|secret|token|api[_-]?key|authorization)\\s*[=:]\\s*\\S+", "$1=[REDACTED]")
          - replace_pattern(body, "\\b\\d{4}[- ]?\\d{4}[- ]?\\d{4}[- ]?\\d{4}\\b", "[CARD-REDACTED]")
          - replace_pattern(body, "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}", "[EMAIL-REDACTED]")