Instrumentation bloat

​

Signals

• Fields that describe SDKs, agents, collectors, exporters, or instrumentation libraries.
• Version fields for telemetry tooling.
• Internal Kubernetes UIDs when human-readable Kubernetes names are also present.
• Fields the telemetry pipeline adds on its own rather than fields from application code.
• Fields you query only when debugging the telemetry tooling itself.

​

Example

{
  "@timestamp": "2024-01-15T10:30:00Z",
  "severity_text": "ERROR",
  "service.name": "checkout-api",
  "telemetry.sdk.name": "opentelemetry",
  "telemetry.sdk.version": "1.24.0",
  "telemetry.sdk.language": "python",
  "message": "Connection timeout"
}

{
  "@timestamp": "2024-01-15T10:30:00Z",
  "severity_text": "ERROR",
  "service.name": "checkout-api",
  "message": "Connection timeout"
}

id: remove-otel-sdk-metadata
name: Remove OTel SDK metadata
description: Drop OpenTelemetry SDK version info. Only useful when debugging the SDK itself.
log:
  match:
    - resource_attribute: telemetry.sdk.name
      exists: true
  transform:
    remove:
      - resource_attribute: telemetry.sdk.name
      - resource_attribute: telemetry.sdk.version
      - resource_attribute: telemetry.sdk.language
      - resource_attribute: telemetry.auto.version

{
  "@timestamp": "2024-01-15T10:30:00Z",
  "severity_text": "ERROR",
  "service.name": "checkout-api",
  "k8s.pod.name": "checkout-api-7d8f9",
  "k8s.pod.uid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "k8s.deployment.name": "checkout-api",
  "k8s.deployment.uid": "12345678-abcd-efgh-ijkl-mnopqrstuvwx",
  "message": "Connection timeout"
}

{
  "@timestamp": "2024-01-15T10:30:00Z",
  "severity_text": "ERROR",
  "service.name": "checkout-api",
  "k8s.pod.name": "checkout-api-7d8f9",
  "k8s.deployment.name": "checkout-api",
  "message": "Connection timeout"
}

id: remove-k8s-uids
name: Remove Kubernetes UIDs
description: Drop internal Kubernetes identifiers. Names are sufficient for debugging.
log:
  match:
    - resource_attribute: k8s.pod.uid
      exists: true
  transform:
    remove:
      - resource_attribute: k8s.pod.uid
      - resource_attribute: k8s.replicaset.uid
      - resource_attribute: k8s.deployment.uid
      - resource_attribute: k8s.statefulset.uid
      - resource_attribute: k8s.daemonset.uid
      - resource_attribute: k8s.job.uid
      - resource_attribute: k8s.cronjob.uid

​

Recommended enforcement

​

Detection notes

• Tero maps dependencies and instrumentation metadata to distinguish tooling fields from application fields.
• Tero flags fields such as telemetry.sdk.version and otel.library.name when they come from telemetry tooling.
• It does not classify system identity fields such as service.name as instrumentation bloat.
• Tero removes Kubernetes UID fields when it keeps the human-readable names.