Related: #92337. When tracing REST requests with APM, we capture HTTP headers as labels on the trace, but redact sensitive values. However, we can't know ahead of time what are all possible sensitive values. It would be better if it was possible to configure additional patterns to redact.
modules/apm/src/main/java/org/elasticsearch/tracing/apm/APMAgentSettings.java
final String completeKey = "elastic.apm." + Objects.requireNonNull(key);
        AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
            if (value == null || value.isEmpty()) {
                LOGGER.trace("Clearing system property [{}]", completeKey);
                System.clearProperty(completeKey);
            } else {
                LOGGER.trace("Setting setting property [{}] to [{}]", completeKey, value);
                System.setProperty(completeKey, value);
            }
            return null;
        });
    }
    private static final String APM_SETTING_PREFIX = "tracing.apm.";
    /**
     * A list of APM agent config keys that should never be configured by the user.
     */
    private static final List<String> PROHIBITED_AGENT_KEYS = List.of(
        
        "config_file",
        
        "recording"
    );
    static final Setting.AffixSetting<String> APM_AGENT_SETTINGS = Setting.prefixKeySetting(
        APM_SETTING_PREFIX + "agent.",
        (qualifiedKey) -> {
            final String[] parts = qualifiedKey.split("\\.");
            final String key = parts[parts.length - 1];
            final String defaultValue = APM_AGENT_DEFAULT_SETTINGS.getOrDefault(key, "");
            return new Setting<>(qualifiedKey, defaultValue, (value) -> {
                if (PROHIBITED_AGENT_KEYS.contains(key)) {