Related: #92337. When tracing REST requests with APM, we capture HTTP headers as labels on the trace, but redact sensitive values. However, we can't know ahead of time what are all possible sensitive values. It would be better if it was possible to configure additional patterns to redact.
modules/apm/src/main/java/org/elasticsearch/tracing/apm/APMTracer.java
final String traceParentHeader = threadContext.getTransient("parent_" + Task.TRACE_PARENT_HTTP_HEADER);
            final String traceStateHeader = threadContext.getTransient("parent_" + Task.TRACE_STATE);
            if (traceParentHeader != null) {
                final Map<String, String> traceContextMap = Maps.newMapWithExpectedSize(2);
                
                traceContextMap.put(Task.TRACE_PARENT_HTTP_HEADER, traceParentHeader);
                if (traceStateHeader != null) {
                    traceContextMap.put(Task.TRACE_STATE, traceStateHeader);
                }
                parentContext = services.openTelemetry.getPropagators()
                    .getTextMapPropagator()
                    .extract(Context.current(), traceContextMap, new MapKeyGetter());
            }
        }
        return parentContext;
    }
    /**
     * Most of the examples of how to use the OTel API look something like this, where the span context
     * is automatically propagated:
     *
     * <pre>{@code
     * Span span = tracer.spanBuilder("parent").startSpan();
     * try (Scope scope = parentSpan.makeCurrent()) {
     *     // ...do some stuff, possibly creating further spans
     * } finally {
     *     span.end();
     * }
     * }</pre>
     * This typically isn't useful in Elasticsearch, because a {@link Scope} can't be used across threads.
     * However, if a scope is active, then the APM agent can capture additional information, so this method