Filter function parameters

You can store function parameters for languages supported through our OpenTelemetry beta Storing function parameters makes it possible to view the parameters that background jobs or scripts started with. It’s not meant to store the parameters for each function call in a trace, only the top-level parameters.

Function parameter data may contain user-identifiable information such as email addresses, API tokens, etc. To protect your application’s sensitive data, you must ensure this data is filtered out before being sent to the AppSignal servers. This way, your application doesn’t leak any sensitive data.

Your application should not collect user-identifiable information (such as personal names, email addresses, passwords, etc.). Use the tools described in this guide to limit and filter out this data.

Function Parameter Filtering

Function parameter filtering works with a denylist: a list of keys to filter out and not to send. You can set a “filter function parameters” option with a list of parameter keys to filter.

Values of parameters you’ve configured to filter out will be replaced with a [FILTERED] value. This way, the list of parameters in the app data on AppSignal.com still includes the parameter key but not the value, so you still have visibility that a value had potentially sensitive data filtered out before being sent to AppSignal.

Example

For example, an application with this AppSignal config:

YAML

filter_function_parameters: ["secret_key"]

Results in this view for the parameters of a trace on AppSignal.com:

JSON

{
  "secret_key": "[FILTERED]"
}

This guide will show you how to configure your application’s function parameter filtering denylist based on what language your application uses:

• Go
• Java
• PHP

Go

Use the filter_function_parameters denylist for function parameter filtering. Set the send_function_parameters option to true to avoid sending any function parameters.

For more information on configuring OpenTelemetry for Go apps, see the Go configuration page.

Go

res := resource.NewWithAttributes(
	attribute.StringSlice("appsignal.config.filter_function_parameters", []string{"api_token", "secret"}),
)

Java

Use the filter_function_parameters denylist for function parameter filtering. Set the send_function_parameters option to true to avoid sending any function parameters.

For more information on configuring OpenTelemetry for Java apps, see the Java configuration page.

Bash

function encode() {
  echo -n "$@" | sed 's/,/%2C/g'
}

export OTEL_RESOURCE_ATTRIBUTES="\
  appsignal.config.filter_function_parameters=$(encode "api_token,secret"),\
  ..."

PHP

Use the filter_function_parameters denylist for function parameter filtering. Set the send_function_parameters option to true to avoid sending any function parameters.

For more information on configuring AppSignal for PHP, see the PHP configuration page.

PHP

return [
    'filter_function_parameters' => ['api_token', 'secret'],
    // ... other options
];