Related: #92337. When tracing REST requests with APM, we capture HTTP headers as labels on the trace, but redact sensitive values. However, we can't know ahead of time what are all possible sensitive values. It would be better if it was possible to configure additional patterns to redact.
modules/apm/src/main/java/org/elasticsearch/tracing/apm/APMTracer.java
if (span != null) {
            span.setAttribute(key, value);
        }
    }
    @Override
    public void setAttribute(String spanId, String key, double value) {
        final var span = Span.fromContextOrNull(spans.get(spanId));
        if (span != null) {
            span.setAttribute(key, value);
        }
    }
    @Override
    public void setAttribute(String spanId, String key, long value) {
        final var span = Span.fromContextOrNull(spans.get(spanId));
        if (span != null) {
            span.setAttribute(key, value);
        }
    }
    @Override
    public void setAttribute(String spanId, String key, String value) {
        final var span = Span.fromContextOrNull(spans.get(spanId));
        if (span != null) {
            span.setAttribute(key, value);
        }
    }
    @Override
    public void stopTrace(String spanId) {
        final var span = Span.fromContextOrNull(spans.remove(spanId));
        if (span != null) {
            logger.trace("Finishing trace [{}]", spanId);