Related: #92337. When tracing REST requests with APM, we capture HTTP headers as labels on the trace, but redact sensitive values. However, we can't know ahead of time what are all possible sensitive values. It would be better if it was possible to configure additional patterns to redact.
modules/apm/src/main/java/org/elasticsearch/tracing/apm/APMTracer.java
Map<String, Context> getSpans() {
        return spans;
    }
    private static CharacterRunAutomaton buildAutomaton(List<String> includeNames, List<String> excludeNames) {
        Automaton includeAutomaton = patternsToAutomaton(includeNames);
        Automaton excludeAutomaton = patternsToAutomaton(excludeNames);
        if (includeAutomaton == null) {
            includeAutomaton = Automata.makeAnyString();
        }
        final Automaton finalAutomaton = excludeAutomaton == null
            ? includeAutomaton
            : Operations.minus(includeAutomaton, excludeAutomaton, Operations.DEFAULT_DETERMINIZE_WORK_LIMIT);
        return new CharacterRunAutomaton(finalAutomaton);
    }
    private static Automaton patternsToAutomaton(List<String> patterns) {
        final List<Automaton> automata = patterns.stream().map(s -> {
            final String regex = s.replaceAll("\\.", "\\\\.").replaceAll("\\*", ".*");
            return new RegExp(regex).toAutomaton();
        }).toList();
        if (automata.isEmpty()) {
            return null;
        }
        if (automata.size() == 1) {
            return automata.get(0);
        }
        return Operations.union(automata);
    }
}