> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usetero.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Instrumentation bloat

> SDK and collector metadata with low diagnostic value

Instrumentation bloat consists of fields added by SDKs, agents, collectors, and exporters. These fields describe the telemetry tooling rather than the observed system.

Some instrumentation fields, such as `service.name`, are operational metadata for system identity and routing. Tooling metadata such as `telemetry.sdk.version`, `otel.library.name`, and collector build strings has low value in logs.

## Signals

* Fields that describe SDKs, agents, collectors, exporters, or instrumentation libraries.
* Version fields for telemetry tooling.
* Internal Kubernetes UIDs when human-readable Kubernetes names are also present.
* Fields the telemetry pipeline adds on its own rather than fields from application code.
* Fields you query only when debugging the telemetry tooling itself.

## Example

<Tabs>
  <Tab title="OTel SDK metadata">
    <Tabs>
      <Tab title="Before">
        ```json theme={null}
        {
          "@timestamp": "2024-01-15T10:30:00Z",
          "severity_text": "ERROR",
          "service.name": "checkout-api",
          "telemetry.sdk.name": "opentelemetry",
          "telemetry.sdk.version": "1.24.0",
          "telemetry.sdk.language": "python",
          "message": "Connection timeout"
        }
        ```
      </Tab>

      <Tab title="After">
        ```json theme={null}
        {
          "@timestamp": "2024-01-15T10:30:00Z",
          "severity_text": "ERROR",
          "service.name": "checkout-api",
          "message": "Connection timeout"
        }
        ```
      </Tab>
    </Tabs>

    ```yaml theme={null}
    id: remove-otel-sdk-metadata
    name: Remove OTel SDK metadata
    description: Drop OpenTelemetry SDK version info. Only useful when debugging the SDK itself.
    log:
      match:
        - resource_attribute: telemetry.sdk.name
          exists: true
      transform:
        remove:
          - resource_attribute: telemetry.sdk.name
          - resource_attribute: telemetry.sdk.version
          - resource_attribute: telemetry.sdk.language
          - resource_attribute: telemetry.auto.version
    ```
  </Tab>

  <Tab title="Kubernetes UIDs">
    <Tabs>
      <Tab title="Before">
        ```json theme={null}
        {
          "@timestamp": "2024-01-15T10:30:00Z",
          "severity_text": "ERROR",
          "service.name": "checkout-api",
          "k8s.pod.name": "checkout-api-7d8f9",
          "k8s.pod.uid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
          "k8s.deployment.name": "checkout-api",
          "k8s.deployment.uid": "12345678-abcd-efgh-ijkl-mnopqrstuvwx",
          "message": "Connection timeout"
        }
        ```
      </Tab>

      <Tab title="After">
        ```json theme={null}
        {
          "@timestamp": "2024-01-15T10:30:00Z",
          "severity_text": "ERROR",
          "service.name": "checkout-api",
          "k8s.pod.name": "checkout-api-7d8f9",
          "k8s.deployment.name": "checkout-api",
          "message": "Connection timeout"
        }
        ```
      </Tab>
    </Tabs>

    Human-readable Kubernetes names remain available after the policy removes internal UIDs.

    ```yaml theme={null}
    id: remove-k8s-uids
    name: Remove Kubernetes UIDs
    description: Drop internal Kubernetes identifiers. Names are sufficient for debugging.
    log:
      match:
        - resource_attribute: k8s.pod.uid
          exists: true
      transform:
        remove:
          - resource_attribute: k8s.pod.uid
          - resource_attribute: k8s.replicaset.uid
          - resource_attribute: k8s.deployment.uid
          - resource_attribute: k8s.statefulset.uid
          - resource_attribute: k8s.daemonset.uid
          - resource_attribute: k8s.job.uid
          - resource_attribute: k8s.cronjob.uid
    ```
  </Tab>
</Tabs>

## Recommended enforcement

<Card title="Enforce at edge" icon="server" href="/policies/enforcement/edge" horizontal>
  Remove low-value instrumentation metadata before data leaves your network.
</Card>

Use edge enforcement when telemetry tooling, not application code, adds the fields.

## Detection notes

* Tero maps dependencies and instrumentation metadata to distinguish tooling fields from application fields.
* Tero flags fields such as `telemetry.sdk.version` and `otel.library.name` when they come from telemetry tooling.
* It does not classify system identity fields such as `service.name` as instrumentation bloat.
* Tero removes Kubernetes UID fields when it keeps the human-readable names.