Live Workshop: Integrate Google SecOps with Bindplane - Join Us on January 29th at 11 AM ET!Sign Up Now

Delete Fields

Description

The Delete Fields processor can be used to remove attributes, resource attributes, log record body keys from telemetry in the pipeline.

warning

This processor has been deprecated and replaced with a new Delete Fields processor that supports additional functionality and improved layout. While it will continue to function, it will no longer receive any enhancements and you should migrate to the new processor. For more information about the new processor, see here.

Supported Types

MetricsLogsTraces

Configuration Table

ParameterTypeDefaultDescription
telemetry_typestelemetrySelector["Logs", "Metrics", "Traces"]The list of telemetry types the processor will act on.
log_conditionstringtrueAn OTTL condition that must evaluate to true to apply this processor. By default, the processor applies to all logs.
log_resource_attributesstrings[]One or more resource attribute names to remove from logs.
log_attributesstrings[]One or more attribute names to remove from logs.
log_body_keysstrings[]One or more body key names to remove from log records.
datapoint_conditionstringtrueAn OTTL condition that must evaluate to true to apply this processor to metrics. By default, the processor applies to all datapoints.
metric_resource_attributesstrings[]One or more resource attribute names to remove from metrics.
metric_attributesstrings[]One or more attribute names to remove from datapoints.
enable_tracesbooltrueIf true, this processor will operate on traces.
span_conditionstringtrueAn OTTL condition that must evaluate to true to apply this processor. By default, the processor applies to all spans.
trace_resource_attributesstrings[]One or more resource attribute names to remove from traces.
trace_attributesstrings[]One or more attribute names to remove from spans.

Example Configuration

This example configuration removes the "host.id" resource attribute, the "log.file.name" attribute, and the "spid" body field from any log record.

Web Interface

observIQ docs - Delete Fields - image 1

Standalone Processor

yaml
1apiVersion: bindplane.observiq.com/v1
2kind: Processor
3metadata:
4  id: delete-fields
5  name: delete-fields
6spec:
7  type: delete_fields
8  parameters:
9    - type: delete_fields
10      parameters:
11        - name: telemetry_types
12          value: ['Logs']
13        - name: log_condition
14          value: 'true'
15        - name: log_resource_attributes
16          value:
17            - host.id
18        - name: log_attributes
19          value:
20            - log.file.name
21        - name: log_body_keys
22          value:
23            - spid
24        - name: datapoint_condition
25          value: 'true'
26        - name: metric_resource_attributes
27          value: []
28        - name: metric_attributes
29          value: []
30        - name: span_condition
31          value: 'true'
32        - name: trace_resource_attributes
33          value: []
34        - name: trace_attributes
35          value: []

Configuration with Embedded Processor

yaml
1apiVersion: bindplane.observiq.com/v1
2kind: Configuration
3metadata:
4  id: delete-fields
5  name: delete-fields
6  labels:
7    platform: linux
8spec:
9  sources:
10    - type: journald
11      parameters:
12        - name: units
13          value: []
14        - name: directory
15          value: ''
16        - name: priority
17          value: info
18        - name: start_at
19          value: end
20      processors:
21        - type: delete_fields
22          parameters:
23            - name: telemetry_types
24              value: ['Logs']
25            - name: log_condition
26              value: 'true'
27            - name: log_resource_attribute
28              value:
29                - host.id
30            - name: log_attributes
31              value:
32                - log.file.name
33            - name: log_body_keys
34              value:
35                - spid
36            - name: datapoint_condition
37              value: 'true'
38            - name: metric_resource_attributes
39              value: []
40            - name: metric_attributes
41              value: []
42            - name: span_condition
43              value: 'true'
44            - name: trace_resource_attributes
45              value: []
46            - name: trace_attributes
47              value: []
48  selector:
49    matchLabels:
50      configuration: delete-fields