Related: #92337. When tracing REST requests with APM, we capture HTTP headers as labels on the trace, but redact sensitive values. However, we can't know ahead of time what are all possible sensitive values. It would be better if it was possible to configure additional patterns to redact.
modules/apm/src/main/java/org/elasticsearch/tracing/apm/APMTracer.java
span.end();
        }
    }
    /**
     * Called when a span ends. This version of the method relies on context to select the span to stop.
     */
    @Override
    public void stopTrace() {
        Span.current().end();
    }
    @Override
    public void addEvent(String spanId, String eventName) {
        final var span = Span.fromContextOrNull(spans.get(spanId));
        if (span != null) {
            span.addEvent(eventName);
        }
    }
    private static class MapKeyGetter implements TextMapGetter<Map<String, String>> {
        @Override
        public Iterable<String> keys(Map<String, String> carrier) {
            return carrier.keySet().stream().filter(APMTracer::isSupportedContextKey).collect(Collectors.toSet());
        }
        @Override
        public String get(Map<String, String> carrier, String key) {
            return carrier.get(key);
        }
    }
    private static boolean isSupportedContextKey(String key) {
        return Task.TRACE_PARENT_HTTP_HEADER.equals(key) || Task.TRACE_STATE.equals(key);
    }