You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/sources/reference/components/loki/loki.secretfilter.md
+7-2Lines changed: 7 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -52,7 +52,7 @@ You can use the following arguments with `loki.secretfilter`:
52
52
|`drop_on_timeout`|`bool`| When true, drop entries that exceed `processing_timeout` instead of forwarding them unredacted. |`false`| no |
53
53
|`gitleaks_config`|`string`| Path to a custom Gitleaks TOML config file. If empty, the default Gitleaks config is used. |`""`| no |
54
54
|`label_timed_out`|`bool`| When true, adds `secretfilter="timed-out"` to entries forwarded after a processing timeout. |`false`| no |
55
-
|`origin_label`|`string`| Loki label to use for the `secrets_redacted_by_origin`metric. If empty, that metric is not registered. |`""`| no |
55
+
|`origin_label`|`string`| Loki label to use as the `origin` dimension in `secrets_redacted_by_origin`and `secrets_redacted_by_category_total`. If empty, `secrets_redacted_by_origin`is not registered and the `origin` label on `secrets_redacted_by_category_total` is set to `""`.|`""`| no |
56
56
|`processing_timeout`|`duration`| Maximum time allowed to process a single log entry. `0` disables the timeout. |`0`| no |
57
57
|`rate`|`float`| Entry sampling rate in `[0.0, 1.0]` where `1` processes all entries. Unsampled entries are forwarded unchanged. |`1.0`| no |
58
58
|`redact_percent`|`uint`| When `redact_with` is not set: percent of the secret to redact (1–100), where 100 is full redaction. |`80`| no |
@@ -67,6 +67,8 @@ The default configuration may change between {{< param "PRODUCT_NAME" >}} versio
67
67
For consistent behavior, use an external configuration file via `gitleaks_config`.
68
68
{{< /admonition >}}
69
69
70
+
If you leave `origin_label` empty, the component doesn't register `secrets_redacted_by_origin` and sets the origin label on `secrets_redacted_by_category_total` to `""`.
71
+
70
72
**Redaction behavior:**
71
73
72
74
- If `redact_with` is set, it is used as the replacement string for every detected secret.
@@ -82,7 +84,9 @@ Entries that {{< param "PRODUCT_NAME" >}} does not select based on the sampling
82
84
Use a value below `1.0`, for example, `0.1` for 10%, to reduce CPU usage when processing high-volume logs.
83
85
Monitor `loki_secretfilter_entries_bypassed_total` to observe how many entries were skipped.
84
86
85
-
**Origin metric:** The `origin_label` argument specifies which Loki label to use for the `secrets_redacted_by_origin` metric, so you can track how many secrets were redacted per source or environment.
87
+
**Origin metric:** The `origin_label` argument specifies the Loki label the component uses as the origin dimension in the `secrets_redacted_by_origin` and `secrets_redacted_by_category_total` metrics.
88
+
You can track how many secrets were redacted per source or environment.
89
+
When `origin_label` isn’t set, the component doesn’t register `secrets_redacted_by_origin`, and the `origin` label on `secrets_redacted_by_category_total` defaults to an empty string.
86
90
87
91
**Processing timeout:** The `processing_timeout` argument sets a maximum duration for processing each log entry.
88
92
When the timeout is exceeded, the `loki_secretfilter_lines_timed_out_total` metric is incremented.
@@ -131,6 +135,7 @@ The following fields are exported and can be referenced by other components:
131
135
|`loki_secretfilter_secrets_redacted_total`| Counter | Total number of secrets redacted. |
132
136
|`loki_secretfilter_secrets_redacted_by_rule_total`| Counter | Number of secrets redacted, partitioned by rule name. |
133
137
|`loki_secretfilter_secrets_redacted_by_origin`| Counter | Number of secrets redacted, partitioned by origin label, when `origin_label` is set. |
138
+
|`loki_secretfilter_secrets_redacted_by_category_total`| Counter | Number of secrets redacted, partitioned by rule name and origin label value. The `origin` label is empty when `origin_label` is not set or the label is absent on the entry. |
0 commit comments