Related: #92337. When tracing REST requests with APM, we capture HTTP headers as labels on the trace, but redact sensitive values. However, we can't know ahead of time what are all possible sensitive values. It would be better if it was possible to configure additional patterns to redact.
modules/apm/src/main/java/org/elasticsearch/tracing/apm/APMTracer.java
@Override
    protected void doStart() {
        if (enabled) {
            this.services = createApmServices();
        }
    }
    @Override
    protected void doStop() {
        destroyApmServices();
    }
    @Override
    protected void doClose() {}
    private APMServices createApmServices() {
        assert this.enabled;
        assert this.services == null;
        return AccessController.doPrivileged((PrivilegedAction<APMServices>) () -> {
            var openTelemetry = GlobalOpenTelemetry.get();
            var tracer = openTelemetry.getTracer("elasticsearch", Version.CURRENT.toString());
            return new APMServices(tracer, openTelemetry);
        });
    }
    private void destroyApmServices() {
        this.services = null;
        this.spans.clear();
    }
    @Override
    public void startTrace(ThreadContext threadContext, String spanId, String spanName, @Nullable Map<String, Object> attributes) {
        assert threadContext != null;
        assert spanId != null;
        assert spanName != null;