receivers:
  otlp:
    protocols:
      grpc:
        endpoint: 0.0.0.0:4317

processors:
  memory_limiter:
    check_interval: 1s
    limit_percentage: 80
    spike_limit_percentage: 25
  # Replaces user IDs with a salted SHA-256: the same user always gets the same
  # value, so per-user queries still work, but the ID itself never leaves.
  # Set USER_ID_SALT to the same secret on every collector that hashes.
  transform/hash-user-ids:
    error_mode: ignore
    log_statements:
      - context: log
        statements:
          - set(attributes["user.id"], SHA256(Concat(["${env:USER_ID_SALT}", attributes["user.id"]], ""))) where attributes["user.id"] != nil
    trace_statements:
      - context: span
        statements:
          - set(attributes["user.id"], SHA256(Concat(["${env:USER_ID_SALT}", attributes["user.id"]], ""))) where attributes["user.id"] != nil
  batch:
    timeout: 5s

exporters:
  otlphttp:
    endpoint: https://your-backend:4318

service:
  pipelines:
    logs:
      receivers: [otlp]
      processors: [memory_limiter, transform/hash-user-ids, batch]
      exporters: [otlphttp]
    traces:
      receivers: [otlp]
      processors: [memory_limiter, transform/hash-user-ids, batch]
      exporters: [otlphttp]