You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/pages/docs/observe/features/manual-tracing/mask-span-attributes.mdx
+39-44Lines changed: 39 additions & 44 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,26 +1,28 @@
1
1
---
2
2
title: "Mask Span Attributes"
3
-
description: "Redact sensitive inputs, outputs, images, and embeddings from spans before they are exported — using environment variables or TraceConfig in code."
3
+
description: "Redact sensitive inputs, outputs, images, and embeddings from spans before they are exported:using environment variables or TraceConfig in code."
4
4
---
5
5
6
-
## What it is
6
+
## About
7
7
8
-
**Mask Span Attributes** lets you control which data gets recorded in your traces. Using environment variables or a `TraceConfig` object passed to any auto-instrumentor, you can hide inputs, outputs, messages, images, text, and embedding vectors before they leave your application. This is useful for preventing sensitive data from being logged and for reducing payload size when working with large base64-encoded images.
8
+
Traces often contain sensitive data: user messages, API responses, PII, or large base64-encoded images. Sending all of this to a trace backend creates privacy, compliance, and payload size problems. Masking span attributes removes or truncates this data before it leaves the application. Configuration is available at two levels: environment variables for global defaults across all instrumentors, and `TraceConfig` in code for per-instrumentor control.
9
9
10
-
## Use cases
10
+
---
11
+
12
+
## When to use
11
13
12
-
-**Privacy and compliance** — Hide user inputs and LLM outputs to prevent sensitive data from being stored in trace backends.
13
-
-**Image redaction** — Suppress base64-encoded images from input messages or cap their length to reduce payload size.
14
-
-**Selective masking** — Hide only specific parts of a span (e.g. input text but not output messages) while keeping the rest visible.
15
-
-**Environment-specific config** — Use environment variables for deployment-level defaults and `TraceConfig` in code for per-instrumentor overrides.
14
+
-**Privacy and compliance**: Hide user inputs and LLM outputs to prevent sensitive data from being stored in trace backends.
15
+
-**Image redaction**: Suppress base64-encoded images from input messages or cap their length to reduce payload size.
16
+
-**Selective masking**: Hide only specific parts of a span (e.g. input text but not output messages) while keeping the rest visible.
17
+
-**Environment-specific config**: Use environment variables for deployment-level defaults and `TraceConfig` in code for per-instrumentor overrides.
16
18
17
19
---
18
20
19
21
## How to
20
22
21
-
<Steps>
22
-
<Steptitle="Review available settings">
23
-
The following environment variables control what gets masked. Set them before your application starts for a global default, or configure them in code using `TraceConfig` (see next step).
23
+
<Tabs>
24
+
<Tabtitle="Environment Variables">
25
+
These apply globally to all instrumentors at startup.
24
26
25
27
| Environment Variable | Description | Type | Default |
@@ -33,10 +35,10 @@ description: "Redact sensitive inputs, outputs, images, and embeddings from span
33
35
|`FI_HIDE_OUTPUT_TEXT`| Hides text from output messages | bool | False |
34
36
|`FI_HIDE_EMBEDDING_VECTORS`| Hides returned embedding vectors | bool | False |
35
37
|`FI_BASE64_IMAGE_MAX_LENGTH`| Caps the character count of a base64 encoded image | int | 32,000 |
36
-
</Step>
38
+
</Tab>
37
39
38
-
<Steptitle="Configure in code with TraceConfig">
39
-
Pass a `TraceConfig` object to any auto-instrumentor to set masking options directly in code. Values set here take precedence over environment variables.
40
+
<Tabtitle="TraceConfig in Code">
41
+
Pass a `TraceConfig` object to any auto-instrumentor for per-instrumentor control. Values set here take precedence over environment variables.
40
42
41
43
<CodeGroup>
42
44
@@ -63,47 +65,40 @@ description: "Redact sensitive inputs, outputs, images, and embeddings from span
-**`TraceConfig`** — An object accepted by all traceAI auto-instrumentors. Use it to specify masking settings directly in code, scoped to a single instrumentor.
99
-
-**Environment variables** — Global defaults applied to all instrumentors. Useful for deployment-level configuration without changing code.
100
-
-**Precedence order** — `TraceConfig` in code → environment variables → default values. More specific settings always win.
101
-
-**`hide_inputs` / `hide_outputs`** — Broad flags that hide all input/output values and messages in one setting.
102
-
-**`base64_image_max_length`** — Caps the logged length of base64-encoded images. Default is 32,000 characters.
93
+
-**`TraceConfig`**:An object accepted by all traceAI auto-instrumentors. Use it to specify masking settings directly in code, scoped to a single instrumentor.
94
+
-**Environment variables**:Global defaults applied to all instrumentors. Useful for deployment-level configuration without changing code.
95
+
-**Precedence order**:`TraceConfig` in code → environment variables → default values. More specific settings always win.
96
+
-**`hide_inputs` / `hide_outputs`**:Broad flags that hide all input/output values and messages in one setting.
97
+
-**`base64_image_max_length`**:Caps the logged length of base64-encoded images. Default is 32,000 characters.
103
98
104
99
---
105
100
106
-
## What you can do next
101
+
## Next Steps
107
102
108
103
<CardGroupcols={2}>
109
104
<Cardtitle="Set Up Tracing"icon="gear"href="/docs/observe/features/manual-tracing/set-up-tracing">
0 commit comments