Redact PII before telemetry leaves the network

The redaction processor's body redaction only masks blocked_values matches; bearer tokens, JWTs, and bare IPs are not in that list, so the transform stage is what catches those in bodies, and it swaps in readable placeholders like *TOKEN* instead of generic masking.

The credit-card regex matches any 13-16 digit run including spaces and dashes, which also hits order IDs and millisecond timestamps; run planted-PII sample data through the config and check for mangled fields before rolling it out.

replace_pattern only works on string bodies. Structured (map) log bodies make the statement error, and error_mode: ignore skips it while logging the error, so key/value bodies are not scrubbed by the transform stage; they are still covered by the redaction processor, which recursively walks map bodies and redacts blocked keys and masks blocked_values in place.

The attributes processor hash action is SHA-1 pseudonymization, not anonymization; hashed user IDs are still personal data under GDPR, and identical inputs always produce identical hashes across your whole estate.

redaction is alpha for logs at v0.146.0 (beta for traces), and summary: debug adds redaction.* attributes (e.g. redaction.masked.count, redaction.redacted.keys) to every affected record, which costs money on per-attribute-billed backends; switch to summary: silent once you trust the rules.