Related: #92337. When tracing REST requests with APM, we capture HTTP headers as labels on the trace, but redact sensitive values. However, we can't know ahead of time what are all possible sensitive values. It would be better if it was possible to configure additional patterns to redact.
modules/apm/src/main/java/org/elasticsearch/tracing/apm/APMTracer.java
var services = this.services;
        if (services == null) {
            return;
        }
        if (filterAutomaton.run(spanName) == false) {
            logger.trace("Skipping tracing [{}] [{}] as it has been filtered out", spanId, spanName);
            return;
        }
        spans.computeIfAbsent(spanId, _spanId -> AccessController.doPrivileged((PrivilegedAction<Context>) () -> {
            logger.trace("Tracing [{}] [{}]", spanId, spanName);
            final SpanBuilder spanBuilder = services.tracer.spanBuilder(spanName);
            
            
            final Context parentContext = getParentContext(threadContext);
            if (parentContext != null) {
                spanBuilder.setParent(parentContext);
            }
            setSpanAttributes(threadContext, attributes, spanBuilder);
            final Span span = spanBuilder.startSpan();
            final Context contextForNewSpan = Context.current().with(span);
            updateThreadContext(threadContext, services, contextForNewSpan);
            return contextForNewSpan;
        }));
    }
    /**
     * Called when a span starts. This version of the method relies on context to assign the span a parent.
     *
     * @param name       the name of the span. Sent to the tracing system
     * @param attributes