Support excluding MDC attributes from capture-all

.github/config/latest-dep-versions.json

@@ -183,6 +183,7 @@
     "io.opentelemetry:opentelemetry-extension-kotlin#+": "1.64.0",
     "io.opentelemetry:opentelemetry-instrumentation-annotations#+": "0.0",
     "io.opentelemetry:opentelemetry-opencensus-shim#+": "0.13.1",
+    "io.opentelemetry:opentelemetry-sdk-common#+": "1.63.0",
     "io.projectreactor.ipc:reactor-netty#+": "0.7.15.RELEASE",
     "io.projectreactor.kafka:reactor-kafka#+": "1.3.25",
     "io.projectreactor.netty:reactor-netty#+": "1.3.6",

docs/instrumentation-list.yaml

@@ -7825,12 +7825,22 @@ libraries:
   - name: otel.instrumentation.jboss-logmanager.experimental.capture-mdc-attributes
     declarative_name: java.jboss_logmanager.capture_mdc_attributes/development
     description: |
-      Controls which MDC attributes to capture. Use "*" to capture all MDC attributes or provide a comma-separated list of specific keys.
+      Controls which MDC attributes to capture. Use "*" to capture all MDC attributes or provide a comma-separated list of specific keys. Entries support glob wildcards ("*" and "?"). Use exclude-mdc-attributes to exclude specific keys.
     type: list
     default: ''
     examples:
     - custom-mdc-key
     - key1,key2,key3
+    - '*'
+  - name: otel.instrumentation.jboss-logmanager.experimental.exclude-mdc-attributes
+    declarative_name: java.jboss_logmanager.exclude_mdc_attributes/development
+    description: |
+      Comma-separated list of MDC attribute keys to exclude from capture, supporting glob wildcards ("*" and "?"). Excludes only take effect alongside a non-empty capture-mdc-attributes list (e.g. capture-mdc-attributes="*" with exclude-mdc-attributes="secret*").
+    type: list
+    default: ''
+    examples:
+    - secret*
+    - key1,key2
 - name: jboss-logmanager-mdc-1.1
   display_name: JBoss Log Manager
   description: |
@@ -10982,12 +10992,22 @@ libraries:
   - name: otel.instrumentation.log4j-appender.experimental.capture-mdc-attributes
     declarative_name: java.log4j_appender.capture_mdc_attributes/development
     description: |
-      Controls which MDC attributes to capture. Use "*" to capture all MDC attributes or provide a comma-separated list of specific keys.
+      Controls which MDC attributes to capture. Use "*" to capture all MDC attributes or provide a comma-separated list of specific keys. Entries support glob wildcards ("*" and "?"). Use exclude-mdc-attributes to exclude specific keys.
     type: list
     default: ''
     examples:
     - custom-mdc-key
     - key1,key2,key3
+    - '*'
+  - name: otel.instrumentation.log4j-appender.experimental.exclude-mdc-attributes
+    declarative_name: java.log4j_appender.exclude_mdc_attributes/development
+    description: |
+      Comma-separated list of MDC attribute keys to exclude from capture, supporting glob wildcards ("*" and "?"). Excludes only take effect alongside a non-empty capture-mdc-attributes list (e.g. capture-mdc-attributes="*" with exclude-mdc-attributes="secret*").
+    type: list
+    default: ''
+    examples:
+    - secret*
+    - key1,key2
   - name: otel.instrumentation.log4j-appender.experimental.capture-code-attributes
     declarative_name: java.log4j_appender.capture_code_attributes/development
     description: |
@@ -11036,12 +11056,21 @@ libraries:
   - name: otel.instrumentation.log4j-appender.experimental.capture-mdc-attributes
     declarative_name: java.log4j_appender.capture_mdc_attributes/development
     description: |
-      Controls which MDC attributes to capture. Use "*" to capture all MDC attributes or provide a comma-separated list of specific keys.
+      Controls which MDC attributes to capture. Use "*" to capture all MDC attributes or provide a comma-separated list of specific keys. Entries support glob wildcards ("*" and "?"). Use exclude-mdc-attributes to exclude specific keys.
     type: list
     default: ''
     examples:
     - '*'
     - key1,key2
+  - name: otel.instrumentation.log4j-appender.experimental.exclude-mdc-attributes
+    declarative_name: java.log4j_appender.exclude_mdc_attributes/development
+    description: |
+      Comma-separated list of MDC attribute keys to exclude from capture, supporting glob wildcards ("*" and "?"). Excludes only take effect alongside a non-empty capture-mdc-attributes list (e.g. capture-mdc-attributes="*" with exclude-mdc-attributes="secret*").
+    type: list
+    default: ''
+    examples:
+    - secret*
+    - key1,key2
 - name: log4j-context-data-2.7
   display_name: Log4j
   description: |
@@ -11234,12 +11263,22 @@ libraries:
   - name: otel.instrumentation.logback-appender.experimental.capture-mdc-attributes
     declarative_name: java.logback_appender.capture_mdc_attributes/development
     description: |
-      Controls which MDC attributes to capture. Use "*" to capture all MDC attributes or provide a comma-separated list of specific keys.
+      Controls which MDC attributes to capture. Use "*" to capture all MDC attributes or provide a comma-separated list of specific keys. Entries support glob wildcards ("*" and "?"). Use exclude-mdc-attributes to exclude specific keys.
     type: list
     default: ''
     examples:
     - custom-mdc-key
     - key1,key2,key3
+    - '*'
+  - name: otel.instrumentation.logback-appender.experimental.exclude-mdc-attributes
+    declarative_name: java.logback_appender.exclude_mdc_attributes/development
+    description: |
+      Comma-separated list of MDC attribute keys to exclude from capture, supporting glob wildcards ("*" and "?"). Excludes only take effect alongside a non-empty capture-mdc-attributes list (e.g. capture-mdc-attributes="*" with exclude-mdc-attributes="secret*").
+    type: list
+    default: ''
+    examples:
+    - secret*
+    - key1,key2
 - name: logback-mdc-1.0
   display_name: Logback
   description: |

instrumentation/jboss-logmanager/README.md

@@ -1,8 +1,9 @@
 # Settings for the JBoss Log Manager instrumentation
 
-| System property                                                             | Type    | Default | Description                                                                                                  |
-| --------------------------------------------------------------------------- | ------- | ------- | ------------------------------------------------------------------------------------------------------------ |
-| `otel.instrumentation.jboss-logmanager.experimental-log-attributes`         | Boolean | `false` | Enable the capture of experimental log attributes `thread.name` and `thread.id`.                             |
-| `otel.instrumentation.jboss-logmanager.experimental.capture-mdc-attributes` | String  |         | Comma separated list of MDC attributes to capture. Use the wildcard character `*` to capture all attributes. |
+| System property                                                             | Type    | Default | Description                                                                                                                                                                                            |
+| --------------------------------------------------------------------------- | ------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `otel.instrumentation.jboss-logmanager.experimental-log-attributes`         | Boolean | `false` | Enable the capture of experimental log attributes `thread.name` and `thread.id`.                                                                                                                       |
+| `otel.instrumentation.jboss-logmanager.experimental.capture-mdc-attributes` | String  |         | Comma separated list of MDC attributes to capture. Use the wildcard character `*` to capture all attributes; glob wildcards (`*` and `?`) are supported. Use `exclude-mdc-attributes` to exclude keys. |
+| `otel.instrumentation.jboss-logmanager.experimental.exclude-mdc-attributes` | String  |         | Comma separated list of MDC attributes to exclude from capture (glob wildcards `*` and `?` supported). Only takes effect alongside a non-empty `capture-mdc-attributes` list.                          |
 
 The `otel.event.name` key is supported in MDC entries. When present, its value is used as the log event name and is not emitted as an attribute.

instrumentation/jboss-logmanager/jboss-logmanager-appender-1.1/javaagent/build.gradle.kts

@@ -8,12 +8,16 @@ muzzle {
     module.set("jboss-logmanager")
     versions.set("[1.1.0.GA,)")
     assertInverse.set(true)
+    extraDependency("io.opentelemetry:opentelemetry-sdk-common:1.59.0")
   }
 }
 
 dependencies {
   library("org.jboss.logmanager:jboss-logmanager:1.1.0.GA")
 
+  // for IncludeExcludePredicate, used to filter captured MDC attributes
+  implementation("io.opentelemetry:opentelemetry-sdk-common")
+
   // ensure no cross interference
   testInstrumentation(project(":instrumentation:java-util-logging:javaagent"))
 }
@@ -28,6 +32,7 @@ tasks {
   withType<Test>().configureEach {
     // TODO run tests both with and without experimental log attributes
     jvmArgs("-Dotel.instrumentation.jboss-logmanager.experimental.capture-mdc-attributes=*")
+    jvmArgs("-Dotel.instrumentation.jboss-logmanager.experimental.exclude-mdc-attributes=excludedKey")
     jvmArgs("-Dotel.instrumentation.jboss-logmanager.experimental-log-attributes=true")
     jvmArgs("-Dotel.instrumentation.java-util-logging.experimental-log-attributes=true")
   }

instrumentation/jboss-logmanager/jboss-logmanager-appender-1.1/javaagent/src/main/java/io/opentelemetry/javaagent/instrumentation/jbosslogmanager/appender/v1_1/LoggingEventMapper.java

@@ -20,10 +20,12 @@
 import io.opentelemetry.context.Context;
 import io.opentelemetry.instrumentation.api.incubator.config.internal.DeclarativeConfigUtil;
 import io.opentelemetry.instrumentation.api.internal.cache.Cache;
-import java.util.ArrayList;
+import io.opentelemetry.sdk.common.internal.IncludeExcludePredicate;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Map;
+import java.util.function.Predicate;
+import javax.annotation.Nullable;
 import org.jboss.logmanager.ExtLogRecord;
 import org.jboss.logmanager.Level;
 import org.jboss.logmanager.Logger;
@@ -54,29 +56,23 @@ public class LoggingEventMapper {
     captureArguments = config.getBoolean("capture_arguments/development", false);
   }
 
-  private final List<AttributeKey<String>> captureMdcAttributeKeys;
-
-  // cached as an optimization
-  private final boolean captureAllMdcAttributes;
+  @Nullable private final Predicate<String> mdcAttributeFilter;
 
   private LoggingEventMapper() {
     List<String> captureMdcAttributes =
         DeclarativeConfigUtil.getInstrumentationConfig(
                 GlobalOpenTelemetry.get(), "jboss_logmanager")
             .getScalarList("capture_mdc_attributes/development", String.class, emptyList());
-    this.captureAllMdcAttributes =
-        captureMdcAttributes.size() == 1 && captureMdcAttributes.get(0).equals("*");
-    if (captureAllMdcAttributes) {
-      this.captureMdcAttributeKeys = emptyList();
-    } else {
-      List<AttributeKey<String>> keys = new ArrayList<>(captureMdcAttributes.size());
-      for (String key : captureMdcAttributes) {
-        if (!OTEL_EVENT_NAME.getKey().equals(key)) {
-          keys.add(getMdcAttributeKey(key));
-        }
-      }
-      this.captureMdcAttributeKeys = keys;
-    }
+    List<String> excludeMdcAttributes =
+        DeclarativeConfigUtil.getInstrumentationConfig(
+                GlobalOpenTelemetry.get(), "jboss_logmanager")
+            .getScalarList("exclude_mdc_attributes/development", String.class, emptyList());
+    // an empty include list captures nothing; excludes only take effect alongside includes
+    this.mdcAttributeFilter =
+        captureMdcAttributes.isEmpty()
+            ? null
+            : IncludeExcludePredicate.createPatternMatching(
+                captureMdcAttributes, excludeMdcAttributes);
   }
 
   public void capture(Logger logger, ExtLogRecord record) {
@@ -144,19 +140,15 @@ private void captureMdcAttributes(LogRecordBuilder builder) {
       builder.setEventName(otelEventName);
     }
 
-    if (captureAllMdcAttributes) {
-      for (Map.Entry<String, String> entry : context.entrySet()) {
-        String key = entry.getKey();
-        if (!OTEL_EVENT_NAME.getKey().equals(key)) {
-          builder.setAttribute(getMdcAttributeKey(key), entry.getValue());
-        }
-      }
+    if (mdcAttributeFilter == null) {
       return;
     }
 
-    for (AttributeKey<String> attributeKey : captureMdcAttributeKeys) {
-      String value = context.get(attributeKey.getKey());
-      builder.setAttribute(attributeKey, value);
+    for (Map.Entry<String, String> entry : context.entrySet()) {
+      String key = entry.getKey();
+      if (!OTEL_EVENT_NAME.getKey().equals(key) && mdcAttributeFilter.test(key)) {
+        builder.setAttribute(getMdcAttributeKey(key), entry.getValue());
+      }
     }
   }
 

instrumentation/jboss-logmanager/jboss-logmanager-appender-1.1/javaagent/src/test/java/io/opentelemetry/javaagent/instrumentation/jbosslogmanager/appender/v1_1/JbossLogmanagerTest.java

@@ -220,12 +220,16 @@ private static void performLogging(
   void testMdc() {
     MDC.put("key1", "val1");
     MDC.put("key2", "val2");
+    // excludedKey is filtered out by the exclude-mdc-attributes config (see build.gradle.kts);
+    // the exact attribute assertions below verify it is not captured
+    MDC.put("excludedKey", "excludedValue");
     MDC.put("otel.event.name", "MyEventName");
     try {
       logger.info("xyz");
     } finally {
       MDC.remove("key1");
       MDC.remove("key2");
+      MDC.remove("excludedKey");
       MDC.remove("otel.event.name");
     }
 

instrumentation/jboss-logmanager/jboss-logmanager-appender-1.1/metadata.yaml

@@ -27,9 +27,22 @@ configurations:
     declarative_name: java.jboss_logmanager.capture_mdc_attributes/development
     description: >
       Controls which MDC attributes to capture. Use "*" to capture all MDC attributes or provide a
-      comma-separated list of specific keys.
+      comma-separated list of specific keys. Entries support glob wildcards ("*" and "?"). Use
+      exclude-mdc-attributes to exclude specific keys.
     type: list
     default: ''
     examples:
       - "custom-mdc-key"
       - "key1,key2,key3"
+      - "*"
+  - name: otel.instrumentation.jboss-logmanager.experimental.exclude-mdc-attributes
+    declarative_name: java.jboss_logmanager.exclude_mdc_attributes/development
+    description: >
+      Comma-separated list of MDC attribute keys to exclude from capture, supporting glob wildcards
+      ("*" and "?"). Excludes only take effect alongside a non-empty capture-mdc-attributes list
+      (e.g. capture-mdc-attributes="*" with exclude-mdc-attributes="secret*").
+    type: list
+    default: ''
+    examples:
+      - "secret*"
+      - "key1,key2"

instrumentation/log4j/log4j-appender-1.2/javaagent/README.md

@@ -1,10 +1,11 @@
 # Settings for the Log4j Appender instrumentation
 
-| System property                                                            | Type    | Default | Description                                                                                                                                   |
-| -------------------------------------------------------------------------- | ------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
-| `otel.instrumentation.log4j-appender.experimental-log-attributes`          | Boolean | `false` | Enable the capture of experimental log attributes `thread.name` and `thread.id`.                                                              |
-| `otel.instrumentation.log4j-appender.experimental.capture-code-attributes` | Boolean | `false` | Enable the capture of [source code attributes]. Note that capturing source code attributes at logging sites might add a performance overhead. |
-| `otel.instrumentation.log4j-appender.experimental.capture-mdc-attributes`  | String  |         | Comma separated list of context data attributes to capture. Use the wildcard character `*` to capture all attributes.                         |
+| System property                                                            | Type    | Default | Description                                                                                                                                                                                                     |
+| -------------------------------------------------------------------------- | ------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `otel.instrumentation.log4j-appender.experimental-log-attributes`          | Boolean | `false` | Enable the capture of experimental log attributes `thread.name` and `thread.id`.                                                                                                                                |
+| `otel.instrumentation.log4j-appender.experimental.capture-code-attributes` | Boolean | `false` | Enable the capture of [source code attributes]. Note that capturing source code attributes at logging sites might add a performance overhead.                                                                   |
+| `otel.instrumentation.log4j-appender.experimental.capture-mdc-attributes`  | String  |         | Comma separated list of context data attributes to capture. Use the wildcard character `*` to capture all attributes; glob wildcards (`*` and `?`) are supported. Use `exclude-mdc-attributes` to exclude keys. |
+| `otel.instrumentation.log4j-appender.experimental.exclude-mdc-attributes`  | String  |         | Comma separated list of context data attributes to exclude from capture (glob wildcards `*` and `?` supported). Only takes effect alongside a non-empty `capture-mdc-attributes` list.                          |
 
 The `otel.event.name` key is supported in MDC entries. When present, its value is used as the log event name and is not emitted as an attribute.
 

instrumentation/log4j/log4j-appender-1.2/javaagent/build.gradle.kts

@@ -8,13 +8,17 @@ muzzle {
     module.set("log4j")
     versions.set("[1.2,)")
     assertInverse.set(true)
+    extraDependency("io.opentelemetry:opentelemetry-sdk-common:1.59.0")
   }
 }
 
 dependencies {
   // 1.2 introduces MDC and there's no version earlier than 1.2.4 available
   library("log4j:log4j:1.2.4")
 
+  // for IncludeExcludePredicate, used to filter captured MDC attributes
+  implementation("io.opentelemetry:opentelemetry-sdk-common")
+
   testInstrumentation(project(":instrumentation:log4j:log4j-appender-2.17:javaagent"))
 }
 
@@ -30,6 +34,7 @@ configurations {
 tasks.withType<Test>().configureEach {
   // TODO run tests both with and without experimental log attributes
   jvmArgs("-Dotel.instrumentation.log4j-appender.experimental.capture-mdc-attributes=*")
+  jvmArgs("-Dotel.instrumentation.log4j-appender.experimental.exclude-mdc-attributes=excludedKey")
   jvmArgs("-Dotel.instrumentation.log4j-appender.experimental.capture-code-attributes=true")
   jvmArgs("-Dotel.instrumentation.log4j-appender.experimental-log-attributes=true")
 }