receivers:
  otlp:
    protocols:
      grpc:
        endpoint: 0.0.0.0:4317

processors:
  memory_limiter:
    check_interval: 1s
    limit_percentage: 80
    spike_limit_percentage: 25
  # Masks by pattern: in a string body, in the top-level values of a map body,
  # and in every log attribute value. Pattern-based, so it masks what LOOKS
  # like PII; see "What it does not catch" on the page.
  transform/mask-pii:
    error_mode: ignore
    log_statements:
      - context: log
        statements:
          # E-mail address
          - replace_pattern(body, "[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\\.[A-Za-z0-9-]+)*\\.[A-Za-z]{2,}", "<email>")
          - replace_all_patterns(attributes, "value", "[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\\.[A-Za-z0-9-]+)*\\.[A-Za-z]{2,}", "<email>")
          - replace_all_patterns(body, "value", "[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\\.[A-Za-z0-9-]+)*\\.[A-Za-z]{2,}", "<email>") where IsMap(body)
          # Visa / Mastercard number, 16 digits, optionally grouped by space or dash
          - replace_pattern(body, "\\b(4[0-9]{3}|5[1-5][0-9]{2}|2[2-7][0-9]{2})([ -]?[0-9]{4}){3}\\b", "<card>")
          - replace_all_patterns(attributes, "value", "\\b(4[0-9]{3}|5[1-5][0-9]{2}|2[2-7][0-9]{2})([ -]?[0-9]{4}){3}\\b", "<card>")
          - replace_all_patterns(body, "value", "\\b(4[0-9]{3}|5[1-5][0-9]{2}|2[2-7][0-9]{2})([ -]?[0-9]{4}){3}\\b", "<card>") where IsMap(body)
          # IBAN (2 letters, 2 check digits, 11 to 30 alphanumerics, optionally grouped by 4)
          - replace_pattern(body, "\\b[A-Z]{2}[0-9]{2}( ?[A-Z0-9]{4}){2,7}( ?[A-Z0-9]{1,3})?\\b", "<iban>")
          - replace_all_patterns(attributes, "value", "\\b[A-Z]{2}[0-9]{2}( ?[A-Z0-9]{4}){2,7}( ?[A-Z0-9]{1,3})?\\b", "<iban>")
          - replace_all_patterns(body, "value", "\\b[A-Z]{2}[0-9]{2}( ?[A-Z0-9]{4}){2,7}( ?[A-Z0-9]{1,3})?\\b", "<iban>") where IsMap(body)
          # Bearer token (20+ token characters after "Bearer ")
          - replace_pattern(body, "(?i)bearer [A-Za-z0-9._~+/=-]{20,}", "Bearer <token>")
          - replace_all_patterns(attributes, "value", "(?i)bearer [A-Za-z0-9._~+/=-]{20,}", "Bearer <token>")
          - replace_all_patterns(body, "value", "(?i)bearer [A-Za-z0-9._~+/=-]{20,}", "Bearer <token>") where IsMap(body)
          # IPv4 address
          - replace_pattern(body, "\\b((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\b", "<ip>")
          - replace_all_patterns(attributes, "value", "\\b((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\b", "<ip>")
          - replace_all_patterns(body, "value", "\\b((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\b", "<ip>") where IsMap(body)
  batch:
    timeout: 5s

exporters:
  otlphttp:
    endpoint: https://your-backend:4318

service:
  pipelines:
    logs:
      receivers: [otlp]
      processors: [memory_limiter, transform/mask-pii, batch]
      exporters: [otlphttp]