OpenTelemetry Transformation Language (OTTL) complete reference and patterns. Triggers on OTTL, transformation, filtering, data processing, telemetry manipulation.
Complete reference and production patterns for the OpenTelemetry Transformation Language. OTTL enables powerful data transformation, filtering, and enrichment within the OpenTelemetry Collector.
| Context | Description | Use With |
|---|---|---|
resource | Resource-level attributes | All signal types |
scope | Instrumentation scope | All signal types |
span | Span data | Traces only |
spanevent | Span events | Traces only |
metric | Metric metadata | Metrics only |
datapoint | Metric data points | Metrics only |
log | Log records | Logs only |
Navigate telemetry data using dot notation:
span.name
span.attributes["http.method"]
resource.attributes["service.name"]
log.body["message"]
metric.name
| Function | Purpose | Example |
|---|---|---|
set | Set a field value | set(span.attributes["env"], "prod") |
delete_key | Remove map key | delete_key(span.attributes, "internal.key") |
delete_matching_keys | Remove keys by pattern | delete_matching_keys(span.attributes, "^temp\\.") |
replace_pattern | Replace text via regex | replace_pattern(log.body["string"], "\\d{4}", "****") |
merge_maps | Merge two maps | merge_maps(span.attributes, resource.attributes, "upsert") |
flatten | Flatten nested structures | flatten(span.attributes, "nested.", 2) |
limit | Limit map size | limit(span.attributes, 50, ["trace.id"]) |
truncate_all | Truncate string values | truncate_all(span.attributes, 1024) |
IsString(span.attributes["user.id"])
IsInt(span.attributes["http.status_code"])
IsMap(span.attributes["metadata"])
IsMatch(metric.name, "^k8s\\.")
String(span.attributes["http.status_code"])
Int(span.attributes["duration_ms"])
Double(span.attributes["cpu_usage"])
Bool(span.attributes["is_error"])
Concat([resource.attributes["service.name"], span.name], ".")
Substring(log.body["string"], 0, 100)
ToLowerCase(span.attributes["http.method"])
Split(span.attributes["tags"], ",")
Trim(log.body["message"])
ParseJSON(log.body["json_data"])
ExtractPatterns(log.body["string"], "user=(?P<user>\\w+)")
ParseKeyValue(log.body["kv_data"], "=", " ")
SHA256(span.attributes["user.email"])
MD5(span.attributes["session.id"])