Related: #92337. When tracing REST requests with APM, we capture HTTP headers as labels on the trace, but redact sensitive values. However, we can't know ahead of time what are all possible sensitive values. It would be better if it was possible to configure additional patterns to redact.
modules/apm/src/test/java/org/elasticsearch/tracing/apm/APMTracerTests.java
/**
     * Check that when a tracer has a list of exclude names configured, then those
     * names are used to filter spans.
     */
    public void test_whenTraceStarted_andSpanNameExcluded_thenSpanIsNotStarted() {
        final List<String> excludePatterns = List.of(
            
            "name-aaa",
            
            "name-b*"
        );
        Settings settings = Settings.builder()
            .put(APM_ENABLED_SETTING.getKey(), true)
            .putList(APM_TRACING_NAMES_EXCLUDE_SETTING.getKey(), excludePatterns)
            .build();
        APMTracer apmTracer = buildTracer(settings);
        apmTracer.startTrace(new ThreadContext(settings), "id1", "name-aaa", null);
        apmTracer.startTrace(new ThreadContext(settings), "id2", "name-bbb", null);
        apmTracer.startTrace(new ThreadContext(settings), "id3", "name-ccc", null);
        assertThat(apmTracer.getSpans(), not(hasKey("id1")));
        assertThat(apmTracer.getSpans(), not(hasKey("id2")));
        assertThat(apmTracer.getSpans(), hasKey("id3"));
    }
    private APMTracer buildTracer(Settings settings) {
        APMTracer tracer = new APMTracer(settings);
        tracer.doStart();
        return tracer;
    }
}