      bearer_do_redact                      = local.bearer_do_redact
      bearer_do_tag                         = local.bearer_do_tag
      bearer_needs_combined                 = local.bearer_needs_combined
      bearer_token_redaction_replacement    = var.bearer_token_redaction_replacement
      bearer_token_services_arr             = local.bearer_token_services_arr
      bearer_token_exclusion_condition      = local.bearer_token_exclusion_condition
      bearer_token_logs_input               = local.bearer_token_logs_input
      aws_key_do_redact                     = local.aws_key_do_redact
      aws_key_do_tag                        = local.aws_key_do_tag
      aws_key_needs_combined                = local.aws_key_needs_combined
      aws_access_key_redaction_replacement  = var.aws_access_key_redaction_replacement
      aws_key_services_arr                  = local.aws_key_services_arr
      aws_key_string_exclusion_condition    = local.aws_key_string_exclusion_condition
      aws_key_attr_exclusion_condition      = local.aws_key_attr_exclusion_condition
      aws_key_logs_input                    = local.aws_key_logs_input
      jwt_do_redact                         = local.jwt_do_redact
      jwt_do_tag                            = local.jwt_do_tag
      jwt_needs_combined                    = local.jwt_needs_combined
      jwt_redaction_replacement             = var.jwt_redaction_replacement
      jwt_services_arr                      = local.jwt_services_arr
      jwt_exclusion_condition               = local.jwt_exclusion_condition
      jwt_logs_input                        = local.jwt_logs_input

terraform {
  required_version = ">= 1.9.0"

  required_providers {
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = ">= 2.20"
    }
    helm = {
      source  = "hashicorp/helm"
      version = ">= 2.10"
    }
  }
}

locals {
  audit_drop_condition = length(var.audit_drop_patterns) == 0 ? "true" : join(
    " && ",
    [for p in var.audit_drop_patterns : "!match(msg, r'${p}')"],
  )

  bearer_token_exclusion_condition = length(var.bearer_token_redaction_exclusion_patterns) == 0 ? "true" : join(
    " && ",
    [for p in var.bearer_token_redaction_exclusion_patterns : "!contains(combined, \"${p}\")"],
  )

  bearer_token_services_arr = "[\"${join("\", \"", var.bearer_token_redaction_services)}\"]"

  # dry_run always wins over enabled for both scanner types
  email_do_redact = var.email_redaction_enabled && !var.email_redaction_dry_run
  email_do_tag    = var.email_redaction_dry_run

  bearer_do_redact = var.bearer_token_redaction_enabled && !var.bearer_token_redaction_dry_run
  bearer_do_tag    = var.bearer_token_redaction_dry_run

  # named output of each stage used to wire transform inputs and the final sink
  email_stage_output = (
    local.email_do_redact ? "redact_emails_logs" :
    local.email_do_tag    ? "tag_emails_logs" :
    "normalize_logs"
  )

  bearer_stage_active   = local.bearer_do_redact || local.bearer_do_tag
  bearer_stage_output   = local.bearer_do_redact ? "redact_bearer_tokens_logs" : "tag_bearer_tokens_logs"
  bearer_needs_combined = length(var.bearer_token_redaction_exclusion_patterns) > 0

  bearer_token_logs_input = local.email_stage_output

  # AWS Access Key ID scanner
  aws_key_do_redact = var.aws_access_key_redaction_enabled && !var.aws_access_key_redaction_dry_run
  aws_key_do_tag    = var.aws_access_key_redaction_dry_run

  aws_key_services_arr = "[\"${join("\", \"", var.aws_access_key_redaction_services)}\"]"

  aws_key_string_exclusion_condition = length(var.aws_access_key_redaction_exclusion_patterns) == 0 ? "true" : join(
    " && ",
    [for p in var.aws_access_key_redaction_exclusion_patterns : "!contains(combined, \"${p}\")"],
  )

  # Each entry generates a VRL boolean: true when the attribute matches and should be excluded.
  # Uses quoted path access (.attributes."dotted.key") which is infallible; returns null for missing paths.
  aws_key_attr_exclusion_condition = length(var.aws_access_key_redaction_exclusion_attributes) == 0 ? "false" : join(
    " || ",
    [for k, v in var.aws_access_key_redaction_exclusion_attributes :
      "(to_string(.attributes.\"${k}\") ?? \"\") == \"${v}\""
    ],
  )

  aws_key_stage_active   = local.aws_key_do_redact || local.aws_key_do_tag
  aws_key_stage_output   = local.aws_key_do_redact ? "redact_aws_access_keys_logs" : "tag_aws_access_keys_logs"
  aws_key_needs_combined = length(var.aws_access_key_redaction_exclusion_patterns) > 0

  aws_key_logs_input = local.bearer_stage_active ? local.bearer_stage_output : local.email_stage_output

  # JWT scanner
  jwt_do_redact = var.jwt_redaction_enabled && !var.jwt_redaction_dry_run
  jwt_do_tag    = var.jwt_redaction_dry_run

  jwt_services_arr = "[\"${join("\", \"", var.jwt_redaction_services)}\"]"

  jwt_exclusion_condition = length(var.jwt_redaction_exclusion_patterns) == 0 ? "true" : join(
    " && ",
    [for p in var.jwt_redaction_exclusion_patterns : "!contains(combined, \"${p}\")"],
  )

  jwt_stage_active   = local.jwt_do_redact || local.jwt_do_tag
  jwt_stage_output   = local.jwt_do_redact ? "redact_jwts_logs" : "tag_jwts_logs"
  jwt_needs_combined = length(var.jwt_redaction_exclusion_patterns) > 0

  jwt_logs_input = (
    local.aws_key_stage_active ? local.aws_key_stage_output :
    local.bearer_stage_active  ? local.bearer_stage_output :
    local.email_stage_output
  )

  logs_sink_input = (
    local.jwt_stage_active     ? local.jwt_stage_output :
    local.aws_key_stage_active ? local.aws_key_stage_output :
    local.bearer_stage_active  ? local.bearer_stage_output :
    local.email_stage_output
  )

  rendered_values = var.additional_config != null ? yamlencode({ customConfig = var.additional_config }) : templatefile(
    "${path.module}/templates/values.yaml.tpl",
    {
      replicas                              = var.replicas
      requests_cpu                          = var.resources_requests.cpu
      requests_memory                       = var.resources_requests.memory
      limits_cpu                            = var.resources_limits.cpu
      limits_memory                         = var.resources_limits.memory
      datadog_site                          = var.datadog_site
      audit_drop_condition                  = local.audit_drop_condition
      email_do_redact                       = local.email_do_redact
      email_do_tag                          = local.email_do_tag
      email_redaction_replacement           = var.email_redaction_replacement
      service_monitor_enabled               = var.service_monitor_enabled
      bearer_do_redact                      = local.bearer_do_redact
      bearer_do_tag                         = local.bearer_do_tag
      bearer_token_redaction_replacement    = var.bearer_token_redaction_replacement
      bearer_token_services_arr             = local.bearer_token_services_arr
      bearer_token_exclusion_condition      = local.bearer_token_exclusion_condition
      bearer_token_logs_input               = local.bearer_token_logs_input
      aws_key_do_redact                     = local.aws_key_do_redact
      aws_key_do_tag                        = local.aws_key_do_tag
      aws_access_key_redaction_replacement  = var.aws_access_key_redaction_replacement
      aws_key_services_arr                  = local.aws_key_services_arr
      aws_key_string_exclusion_condition    = local.aws_key_string_exclusion_condition
      aws_key_attr_exclusion_condition      = local.aws_key_attr_exclusion_condition
      aws_key_logs_input                    = local.aws_key_logs_input
      jwt_do_redact                         = local.jwt_do_redact
      jwt_do_tag                            = local.jwt_do_tag
      jwt_redaction_replacement             = var.jwt_redaction_replacement
      jwt_services_arr                      = local.jwt_services_arr
      jwt_exclusion_condition               = local.jwt_exclusion_condition
      jwt_logs_input                        = local.jwt_logs_input
      logs_sink_input                       = local.logs_sink_input
    },
  )
}

resource "kubernetes_namespace_v1" "vector" {
  metadata {
    name = var.namespace
    labels = {
      "app.kubernetes.io/name"      = "vector"
      "app.kubernetes.io/component" = "telemetry-aggregator"
    }
  }
}

resource "kubernetes_manifest" "datadog_external_secret" {
  manifest = {
    apiVersion = "external-secrets.io/v1"
    kind       = "ExternalSecret"
    metadata = {
      name      = "vector-datadog"
      namespace = kubernetes_namespace_v1.vector.metadata[0].name
    }
    spec = {
      refreshInterval = "1h"
      secretStoreRef = {
        kind = "ClusterSecretStore"
        name = var.external_secrets_cluster_store_name
      }
      target = {
        name           = "vector-datadog"
        creationPolicy = "Owner"
      }
      data = [{
        secretKey = "api_key"
        remoteRef = {
          key      = var.datadog_api_key_vault_path
          property = "apiKey"
        }
      }]
    }
  }

  wait {
    fields = {
      "status.conditions[0].type"   = "Ready"
      "status.conditions[0].status" = "True"
    }
  }

  timeouts {
    create = "5m"
    update = "5m"
  }
}

resource "helm_release" "vector" {
  name       = "vector"
  namespace  = kubernetes_namespace_v1.vector.metadata[0].name
  repository = "https://helm.vector.dev"
  chart      = "vector"
  version    = var.chart_version

  values = [local.rendered_values]

  set {
    name  = "image.repository"
    value = var.image
  }
  set {
    name  = "image.tag"
    value = var.image_tag_version
  }

  depends_on = [
    kubernetes_manifest.datadog_external_secret,
  ]
}

module "netpol" {
  source = "crow.infrastructure.immuta.io/internal/security-network-policy/kubernetes"
  version = "1.1.0"

  name             = "vector-netpol"
  namespace        = var.namespace
  network_policies = local.netpols

  depends_on = [
    kubernetes_namespace_v1.vector,
  ]
}

bearer_do_tag                         = local.bearer_do_tag

+      bearer_needs_combined                 = local.bearer_needs_combined

aws_key_do_tag                        = local.aws_key_do_tag

+      aws_key_needs_combined                = local.aws_key_needs_combined

jwt_do_redact                         = local.jwt_do_redact

jwt_do_tag                            = local.jwt_do_tag

+      jwt_needs_combined                    = local.jwt_needs_combined


I get the following message, can you take a look? 2026-05-11T16:33:07.085888Z  WARN transform{component_kind="transform" component_id=tag_aws_access_keys_logs component_type=remap}: vector::transforms…


Fix unused variable warning in VRL remap transform


Now update the template to conditionally emit `combined` for all 6 occurrences. Starting with the bearer token transforms:


Edit

        bearer_re = r'(?i)Bearer\s+[A-Za-z0-9+/._~-]+=*'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${bearer_token_services_arr}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${bearer_token_exclusion_condition}

        bearer_re = r'(?i)Bearer\s+[A-Za-z0-9+/._~-]+=*'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if bearer_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${bearer_token_services_arr}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${bearer_token_exclusion_condition}


The file /Users/steve.briggs/projects/operations/terraform/internal-modules/kubernetes/monitoring/vector/templates/values.yaml.tpl has been updated successfully. (file state is current in your context — no need to Read it back)

        bearer_re = r'(?i)Bearer\s+[A-Za-z0-9+/._~-]+=*'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if bearer_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${bearer_token_services_arr}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${bearer_token_exclusion_condition}

role: Aggregator
replicas: ${replicas}
podAnnotations:
  reloader.stakater.com/auto: "true"
service:
  enabled: true
  type: ClusterIP
  ports:
    - name: otlp-grpc
      port: 4317
      protocol: TCP
    - name: otlp-http
      port: 4318
      protocol: TCP
    - name: dd-agent
      port: 8282
      protocol: TCP
env:
  - name: DATADOG_API_KEY
    valueFrom:
      secretKeyRef:
        name: vector-datadog
        key: api_key
resources:
  requests:
    cpu: ${requests_cpu}
    memory: ${requests_memory}
  limits:
    cpu: "${limits_cpu}"
    memory: ${limits_memory}
podDisruptionBudget:
  enabled: true
  minAvailable: 2

topologySpreadConstraints:
  - maxSkew: 1
    topologyKey: topology.kubernetes.io/zone
    whenUnsatisfiable: ScheduleAnyway
    labelSelector:
      matchLabels:
        app.kubernetes.io/name: vector

affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          topologyKey: kubernetes.io/hostname
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: vector

%{ if service_monitor_enabled ~}
serviceMonitor:
  enabled: true
%{ endif ~}
customConfig:
  data_dir: /vector-data-dir
  api:
    enabled: true
    address: 0.0.0.0:8686
  sources:
    otlp_in:
      type: opentelemetry
      grpc:
        address: 0.0.0.0:4317
      http:
        address: 0.0.0.0:4318
    dd_agent_in:
      type: datadog_agent
      address: 0.0.0.0:8282
      multiple_outputs: true
      disable_metrics: true
      disable_traces: true
      store_api_key: false
      acknowledgements:
        enabled: true
  transforms:
    drop_audit:
      type: filter
      inputs:
        - otlp_in.logs
        - dd_agent_in.logs
      condition: |
        msg = if is_string(.message) { string!(.message) } else { "" }
        ${audit_drop_condition}
    normalize_logs:
      type: remap
      inputs:
        - drop_audit
      source: |
        if exists(.severity) {
          .status = downcase(to_string!(.severity))
          del(.severity)
        }
%{ if email_do_redact ~}
    redact_emails_logs:
      type: remap
      inputs:
        - normalize_logs
      source: |
        email_re = r'[\w._%+\-]+@[\w.-]+\.[A-Za-z]{2,}'
        if is_string(.message) {
          .message = replace(string!(.message), email_re, "${email_redaction_replacement}")
        }
        if is_object(.attributes) {
          attrs, _err = object(.attributes)
          if is_object(attrs) {
            .attributes = map_values(attrs) -> |v| {
              if is_string(v) { replace(string!(v), email_re, "${email_redaction_replacement}") } else { v }
            }
          }
        }
%{ endif ~}
%{ if email_do_tag ~}
    tag_emails_logs:
      type: remap
      inputs:
        - normalize_logs
      source: |
        email_re = r'[\w._%+\-]+@[\w.-]+\.[A-Za-z]{2,}'
        detected = false
        if is_string(.message) {
          detected = match(string!(.message), email_re)
        }
        if !detected && is_object(.attributes) {
          detected = match(encode_json(.attributes), email_re)
        }
        if detected {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if bearer_do_redact ~}
    redact_bearer_tokens_logs:
      type: remap
      inputs:
        - ${bearer_token_logs_input}
      source: |
        bearer_re = r'(?i)Bearer\s+[A-Za-z0-9+/._~-]+=*'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${bearer_token_services_arr}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${bearer_token_exclusion_condition}
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), bearer_re, "${bearer_token_redaction_replacement}")
        }
%{ endif ~}
%{ if bearer_do_tag ~}
    tag_bearer_tokens_logs:
      type: remap
      inputs:
        - ${bearer_token_logs_input}
      source: |
        bearer_re = r'(?i)Bearer\s+[A-Za-z0-9+/._~-]+=*'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${bearer_token_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${bearer_token_exclusion_condition}
        if would_redact && is_string(.message) && match(string!(.message), bearer_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if aws_key_do_redact ~}
    redact_aws_access_keys_logs:
      type: remap
      inputs:
        - ${aws_key_logs_input}
      source: |
        aws_key_re = r'(AKIA|ASIA|AROA|AIPA|ANPA|ANVA|APKA)[A-Z0-9]{16}'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${aws_key_services_arr}
        attr_excluded = ${aws_key_attr_exclusion_condition}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${aws_key_string_exclusion_condition} && !attr_excluded
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), aws_key_re, "${aws_access_key_redaction_replacement}")
        }
%{ endif ~}
%{ if aws_key_do_tag ~}
    tag_aws_access_keys_logs:
      type: remap
      inputs:
        - ${aws_key_logs_input}
      source: |
        aws_key_re = r'(AKIA|ASIA|AROA|AIPA|ANPA|ANVA|APKA)[A-Z0-9]{16}'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${aws_key_services_arr}
        attr_excluded = ${aws_key_attr_exclusion_condition}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${aws_key_string_exclusion_condition} && !attr_excluded
        if would_redact && is_string(.message) && match(string!(.message), aws_key_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if jwt_do_redact ~}
    redact_jwts_logs:
      type: remap
      inputs:
        - ${jwt_logs_input}
      source: |
        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${jwt_services_arr}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), jwt_re, "${jwt_redaction_replacement}")
        }
%{ endif ~}
%{ if jwt_do_tag ~}
    tag_jwts_logs:
      type: remap
      inputs:
        - ${jwt_logs_input}
      source: |
        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${jwt_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}
        if would_redact && is_string(.message) && match(string!(.message), jwt_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
  sinks:
    datadog_logs:
      type: datadog_logs
      inputs:
        - ${logs_sink_input}
      default_api_key: $${DATADOG_API_KEY}
      site: ${datadog_site}


        bearer_re = r'(?i)Bearer\s+[A-Za-z0-9+/._~-]+=*'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${bearer_token_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${bearer_token_exclusion_condition}

        bearer_re = r'(?i)Bearer\s+[A-Za-z0-9+/._~-]+=*'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if bearer_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${bearer_token_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${bearer_token_exclusion_condition}


        bearer_re = r'(?i)Bearer\s+[A-Za-z0-9+/._~-]+=*'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if bearer_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${bearer_token_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${bearer_token_exclusion_condition}

role: Aggregator
replicas: ${replicas}
podAnnotations:
  reloader.stakater.com/auto: "true"
service:
  enabled: true
  type: ClusterIP
  ports:
    - name: otlp-grpc
      port: 4317
      protocol: TCP
    - name: otlp-http
      port: 4318
      protocol: TCP
    - name: dd-agent
      port: 8282
      protocol: TCP
env:
  - name: DATADOG_API_KEY
    valueFrom:
      secretKeyRef:
        name: vector-datadog
        key: api_key
resources:
  requests:
    cpu: ${requests_cpu}
    memory: ${requests_memory}
  limits:
    cpu: "${limits_cpu}"
    memory: ${limits_memory}
podDisruptionBudget:
  enabled: true
  minAvailable: 2

topologySpreadConstraints:
  - maxSkew: 1
    topologyKey: topology.kubernetes.io/zone
    whenUnsatisfiable: ScheduleAnyway
    labelSelector:
      matchLabels:
        app.kubernetes.io/name: vector

affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          topologyKey: kubernetes.io/hostname
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: vector

%{ if service_monitor_enabled ~}
serviceMonitor:
  enabled: true
%{ endif ~}
customConfig:
  data_dir: /vector-data-dir
  api:
    enabled: true
    address: 0.0.0.0:8686
  sources:
    otlp_in:
      type: opentelemetry
      grpc:
        address: 0.0.0.0:4317
      http:
        address: 0.0.0.0:4318
    dd_agent_in:
      type: datadog_agent
      address: 0.0.0.0:8282
      multiple_outputs: true
      disable_metrics: true
      disable_traces: true
      store_api_key: false
      acknowledgements:
        enabled: true
  transforms:
    drop_audit:
      type: filter
      inputs:
        - otlp_in.logs
        - dd_agent_in.logs
      condition: |
        msg = if is_string(.message) { string!(.message) } else { "" }
        ${audit_drop_condition}
    normalize_logs:
      type: remap
      inputs:
        - drop_audit
      source: |
        if exists(.severity) {
          .status = downcase(to_string!(.severity))
          del(.severity)
        }
%{ if email_do_redact ~}
    redact_emails_logs:
      type: remap
      inputs:
        - normalize_logs
      source: |
        email_re = r'[\w._%+\-]+@[\w.-]+\.[A-Za-z]{2,}'
        if is_string(.message) {
          .message = replace(string!(.message), email_re, "${email_redaction_replacement}")
        }
        if is_object(.attributes) {
          attrs, _err = object(.attributes)
          if is_object(attrs) {
            .attributes = map_values(attrs) -> |v| {
              if is_string(v) { replace(string!(v), email_re, "${email_redaction_replacement}") } else { v }
            }
          }
        }
%{ endif ~}
%{ if email_do_tag ~}
    tag_emails_logs:
      type: remap
      inputs:
        - normalize_logs
      source: |
        email_re = r'[\w._%+\-]+@[\w.-]+\.[A-Za-z]{2,}'
        detected = false
        if is_string(.message) {
          detected = match(string!(.message), email_re)
        }
        if !detected && is_object(.attributes) {
          detected = match(encode_json(.attributes), email_re)
        }
        if detected {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if bearer_do_redact ~}
    redact_bearer_tokens_logs:
      type: remap
      inputs:
        - ${bearer_token_logs_input}
      source: |
        bearer_re = r'(?i)Bearer\s+[A-Za-z0-9+/._~-]+=*'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if bearer_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${bearer_token_services_arr}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${bearer_token_exclusion_condition}
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), bearer_re, "${bearer_token_redaction_replacement}")
        }
%{ endif ~}
%{ if bearer_do_tag ~}
    tag_bearer_tokens_logs:
      type: remap
      inputs:
        - ${bearer_token_logs_input}
      source: |
        bearer_re = r'(?i)Bearer\s+[A-Za-z0-9+/._~-]+=*'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${bearer_token_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${bearer_token_exclusion_condition}
        if would_redact && is_string(.message) && match(string!(.message), bearer_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if aws_key_do_redact ~}
    redact_aws_access_keys_logs:
      type: remap
      inputs:
        - ${aws_key_logs_input}
      source: |
        aws_key_re = r'(AKIA|ASIA|AROA|AIPA|ANPA|ANVA|APKA)[A-Z0-9]{16}'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${aws_key_services_arr}
        attr_excluded = ${aws_key_attr_exclusion_condition}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${aws_key_string_exclusion_condition} && !attr_excluded
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), aws_key_re, "${aws_access_key_redaction_replacement}")
        }
%{ endif ~}
%{ if aws_key_do_tag ~}
    tag_aws_access_keys_logs:
      type: remap
      inputs:
        - ${aws_key_logs_input}
      source: |
        aws_key_re = r'(AKIA|ASIA|AROA|AIPA|ANPA|ANVA|APKA)[A-Z0-9]{16}'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${aws_key_services_arr}
        attr_excluded = ${aws_key_attr_exclusion_condition}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${aws_key_string_exclusion_condition} && !attr_excluded
        if would_redact && is_string(.message) && match(string!(.message), aws_key_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if jwt_do_redact ~}
    redact_jwts_logs:
      type: remap
      inputs:
        - ${jwt_logs_input}
      source: |
        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${jwt_services_arr}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), jwt_re, "${jwt_redaction_replacement}")
        }
%{ endif ~}
%{ if jwt_do_tag ~}
    tag_jwts_logs:
      type: remap
      inputs:
        - ${jwt_logs_input}
      source: |
        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${jwt_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}
        if would_redact && is_string(.message) && match(string!(.message), jwt_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
  sinks:
    datadog_logs:
      type: datadog_logs
      inputs:
        - ${logs_sink_input}
      default_api_key: $${DATADOG_API_KEY}
      site: ${datadog_site}


Now the two AWS key transforms:


        aws_key_re = r'(AKIA|ASIA|AROA|AIPA|ANPA|ANVA|APKA)[A-Z0-9]{16}'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${aws_key_services_arr}
        attr_excluded = ${aws_key_attr_exclusion_condition}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${aws_key_string_exclusion_condition} && !attr_excluded

        aws_key_re = r'(AKIA|ASIA|AROA|AIPA|ANPA|ANVA|APKA)[A-Z0-9]{16}'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if aws_key_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${aws_key_services_arr}
        attr_excluded = ${aws_key_attr_exclusion_condition}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${aws_key_string_exclusion_condition} && !attr_excluded


        aws_key_re = r'(AKIA|ASIA|AROA|AIPA|ANPA|ANVA|APKA)[A-Z0-9]{16}'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if aws_key_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${aws_key_services_arr}
        attr_excluded = ${aws_key_attr_exclusion_condition}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${aws_key_string_exclusion_condition} && !attr_excluded

role: Aggregator
replicas: ${replicas}
podAnnotations:
  reloader.stakater.com/auto: "true"
service:
  enabled: true
  type: ClusterIP
  ports:
    - name: otlp-grpc
      port: 4317
      protocol: TCP
    - name: otlp-http
      port: 4318
      protocol: TCP
    - name: dd-agent
      port: 8282
      protocol: TCP
env:
  - name: DATADOG_API_KEY
    valueFrom:
      secretKeyRef:
        name: vector-datadog
        key: api_key
resources:
  requests:
    cpu: ${requests_cpu}
    memory: ${requests_memory}
  limits:
    cpu: "${limits_cpu}"
    memory: ${limits_memory}
podDisruptionBudget:
  enabled: true
  minAvailable: 2

topologySpreadConstraints:
  - maxSkew: 1
    topologyKey: topology.kubernetes.io/zone
    whenUnsatisfiable: ScheduleAnyway
    labelSelector:
      matchLabels:
        app.kubernetes.io/name: vector

affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          topologyKey: kubernetes.io/hostname
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: vector

%{ if service_monitor_enabled ~}
serviceMonitor:
  enabled: true
%{ endif ~}
customConfig:
  data_dir: /vector-data-dir
  api:
    enabled: true
    address: 0.0.0.0:8686
  sources:
    otlp_in:
      type: opentelemetry
      grpc:
        address: 0.0.0.0:4317
      http:
        address: 0.0.0.0:4318
    dd_agent_in:
      type: datadog_agent
      address: 0.0.0.0:8282
      multiple_outputs: true
      disable_metrics: true
      disable_traces: true
      store_api_key: false
      acknowledgements:
        enabled: true
  transforms:
    drop_audit:
      type: filter
      inputs:
        - otlp_in.logs
        - dd_agent_in.logs
      condition: |
        msg = if is_string(.message) { string!(.message) } else { "" }
        ${audit_drop_condition}
    normalize_logs:
      type: remap
      inputs:
        - drop_audit
      source: |
        if exists(.severity) {
          .status = downcase(to_string!(.severity))
          del(.severity)
        }
%{ if email_do_redact ~}
    redact_emails_logs:
      type: remap
      inputs:
        - normalize_logs
      source: |
        email_re = r'[\w._%+\-]+@[\w.-]+\.[A-Za-z]{2,}'
        if is_string(.message) {
          .message = replace(string!(.message), email_re, "${email_redaction_replacement}")
        }
        if is_object(.attributes) {
          attrs, _err = object(.attributes)
          if is_object(attrs) {
            .attributes = map_values(attrs) -> |v| {
              if is_string(v) { replace(string!(v), email_re, "${email_redaction_replacement}") } else { v }
            }
          }
        }
%{ endif ~}
%{ if email_do_tag ~}
    tag_emails_logs:
      type: remap
      inputs:
        - normalize_logs
      source: |
        email_re = r'[\w._%+\-]+@[\w.-]+\.[A-Za-z]{2,}'
        detected = false
        if is_string(.message) {
          detected = match(string!(.message), email_re)
        }
        if !detected && is_object(.attributes) {
          detected = match(encode_json(.attributes), email_re)
        }
        if detected {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if bearer_do_redact ~}
    redact_bearer_tokens_logs:
      type: remap
      inputs:
        - ${bearer_token_logs_input}
      source: |
        bearer_re = r'(?i)Bearer\s+[A-Za-z0-9+/._~-]+=*'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if bearer_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${bearer_token_services_arr}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${bearer_token_exclusion_condition}
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), bearer_re, "${bearer_token_redaction_replacement}")
        }
%{ endif ~}
%{ if bearer_do_tag ~}
    tag_bearer_tokens_logs:
      type: remap
      inputs:
        - ${bearer_token_logs_input}
      source: |
        bearer_re = r'(?i)Bearer\s+[A-Za-z0-9+/._~-]+=*'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if bearer_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${bearer_token_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${bearer_token_exclusion_condition}
        if would_redact && is_string(.message) && match(string!(.message), bearer_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if aws_key_do_redact ~}
    redact_aws_access_keys_logs:
      type: remap
      inputs:
        - ${aws_key_logs_input}
      source: |
        aws_key_re = r'(AKIA|ASIA|AROA|AIPA|ANPA|ANVA|APKA)[A-Z0-9]{16}'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${aws_key_services_arr}
        attr_excluded = ${aws_key_attr_exclusion_condition}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${aws_key_string_exclusion_condition} && !attr_excluded
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), aws_key_re, "${aws_access_key_redaction_replacement}")
        }
%{ endif ~}
%{ if aws_key_do_tag ~}
    tag_aws_access_keys_logs:
      type: remap
      inputs:
        - ${aws_key_logs_input}
      source: |
        aws_key_re = r'(AKIA|ASIA|AROA|AIPA|ANPA|ANVA|APKA)[A-Z0-9]{16}'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${aws_key_services_arr}
        attr_excluded = ${aws_key_attr_exclusion_condition}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${aws_key_string_exclusion_condition} && !attr_excluded
        if would_redact && is_string(.message) && match(string!(.message), aws_key_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if jwt_do_redact ~}
    redact_jwts_logs:
      type: remap
      inputs:
        - ${jwt_logs_input}
      source: |
        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${jwt_services_arr}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), jwt_re, "${jwt_redaction_replacement}")
        }
%{ endif ~}
%{ if jwt_do_tag ~}
    tag_jwts_logs:
      type: remap
      inputs:
        - ${jwt_logs_input}
      source: |
        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${jwt_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}
        if would_redact && is_string(.message) && match(string!(.message), jwt_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
  sinks:
    datadog_logs:
      type: datadog_logs
      inputs:
        - ${logs_sink_input}
      default_api_key: $${DATADOG_API_KEY}
      site: ${datadog_site}


        aws_key_re = r'(AKIA|ASIA|AROA|AIPA|ANPA|ANVA|APKA)[A-Z0-9]{16}'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${aws_key_services_arr}
        attr_excluded = ${aws_key_attr_exclusion_condition}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${aws_key_string_exclusion_condition} && !attr_excluded

        aws_key_re = r'(AKIA|ASIA|AROA|AIPA|ANPA|ANVA|APKA)[A-Z0-9]{16}'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if aws_key_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${aws_key_services_arr}
        attr_excluded = ${aws_key_attr_exclusion_condition}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${aws_key_string_exclusion_condition} && !attr_excluded


        aws_key_re = r'(AKIA|ASIA|AROA|AIPA|ANPA|ANVA|APKA)[A-Z0-9]{16}'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if aws_key_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${aws_key_services_arr}
        attr_excluded = ${aws_key_attr_exclusion_condition}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${aws_key_string_exclusion_condition} && !attr_excluded

role: Aggregator
replicas: ${replicas}
podAnnotations:
  reloader.stakater.com/auto: "true"
service:
  enabled: true
  type: ClusterIP
  ports:
    - name: otlp-grpc
      port: 4317
      protocol: TCP
    - name: otlp-http
      port: 4318
      protocol: TCP
    - name: dd-agent
      port: 8282
      protocol: TCP
env:
  - name: DATADOG_API_KEY
    valueFrom:
      secretKeyRef:
        name: vector-datadog
        key: api_key
resources:
  requests:
    cpu: ${requests_cpu}
    memory: ${requests_memory}
  limits:
    cpu: "${limits_cpu}"
    memory: ${limits_memory}
podDisruptionBudget:
  enabled: true
  minAvailable: 2

topologySpreadConstraints:
  - maxSkew: 1
    topologyKey: topology.kubernetes.io/zone
    whenUnsatisfiable: ScheduleAnyway
    labelSelector:
      matchLabels:
        app.kubernetes.io/name: vector

affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          topologyKey: kubernetes.io/hostname
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: vector

%{ if service_monitor_enabled ~}
serviceMonitor:
  enabled: true
%{ endif ~}
customConfig:
  data_dir: /vector-data-dir
  api:
    enabled: true
    address: 0.0.0.0:8686
  sources:
    otlp_in:
      type: opentelemetry
      grpc:
        address: 0.0.0.0:4317
      http:
        address: 0.0.0.0:4318
    dd_agent_in:
      type: datadog_agent
      address: 0.0.0.0:8282
      multiple_outputs: true
      disable_metrics: true
      disable_traces: true
      store_api_key: false
      acknowledgements:
        enabled: true
  transforms:
    drop_audit:
      type: filter
      inputs:
        - otlp_in.logs
        - dd_agent_in.logs
      condition: |
        msg = if is_string(.message) { string!(.message) } else { "" }
        ${audit_drop_condition}
    normalize_logs:
      type: remap
      inputs:
        - drop_audit
      source: |
        if exists(.severity) {
          .status = downcase(to_string!(.severity))
          del(.severity)
        }
%{ if email_do_redact ~}
    redact_emails_logs:
      type: remap
      inputs:
        - normalize_logs
      source: |
        email_re = r'[\w._%+\-]+@[\w.-]+\.[A-Za-z]{2,}'
        if is_string(.message) {
          .message = replace(string!(.message), email_re, "${email_redaction_replacement}")
        }
        if is_object(.attributes) {
          attrs, _err = object(.attributes)
          if is_object(attrs) {
            .attributes = map_values(attrs) -> |v| {
              if is_string(v) { replace(string!(v), email_re, "${email_redaction_replacement}") } else { v }
            }
          }
        }
%{ endif ~}
%{ if email_do_tag ~}
    tag_emails_logs:
      type: remap
      inputs:
        - normalize_logs
      source: |
        email_re = r'[\w._%+\-]+@[\w.-]+\.[A-Za-z]{2,}'
        detected = false
        if is_string(.message) {
          detected = match(string!(.message), email_re)
        }
        if !detected && is_object(.attributes) {
          detected = match(encode_json(.attributes), email_re)
        }
        if detected {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if bearer_do_redact ~}
    redact_bearer_tokens_logs:
      type: remap
      inputs:
        - ${bearer_token_logs_input}
      source: |
        bearer_re = r'(?i)Bearer\s+[A-Za-z0-9+/._~-]+=*'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if bearer_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${bearer_token_services_arr}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${bearer_token_exclusion_condition}
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), bearer_re, "${bearer_token_redaction_replacement}")
        }
%{ endif ~}
%{ if bearer_do_tag ~}
    tag_bearer_tokens_logs:
      type: remap
      inputs:
        - ${bearer_token_logs_input}
      source: |
        bearer_re = r'(?i)Bearer\s+[A-Za-z0-9+/._~-]+=*'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if bearer_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${bearer_token_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${bearer_token_exclusion_condition}
        if would_redact && is_string(.message) && match(string!(.message), bearer_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if aws_key_do_redact ~}
    redact_aws_access_keys_logs:
      type: remap
      inputs:
        - ${aws_key_logs_input}
      source: |
        aws_key_re = r'(AKIA|ASIA|AROA|AIPA|ANPA|ANVA|APKA)[A-Z0-9]{16}'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if aws_key_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${aws_key_services_arr}
        attr_excluded = ${aws_key_attr_exclusion_condition}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${aws_key_string_exclusion_condition} && !attr_excluded
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), aws_key_re, "${aws_access_key_redaction_replacement}")
        }
%{ endif ~}
%{ if aws_key_do_tag ~}
    tag_aws_access_keys_logs:
      type: remap
      inputs:
        - ${aws_key_logs_input}
      source: |
        aws_key_re = r'(AKIA|ASIA|AROA|AIPA|ANPA|ANVA|APKA)[A-Z0-9]{16}'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${aws_key_services_arr}
        attr_excluded = ${aws_key_attr_exclusion_condition}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${aws_key_string_exclusion_condition} && !attr_excluded
        if would_redact && is_string(.message) && match(string!(.message), aws_key_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if jwt_do_redact ~}
    redact_jwts_logs:
      type: remap
      inputs:
        - ${jwt_logs_input}
      source: |
        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${jwt_services_arr}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), jwt_re, "${jwt_redaction_replacement}")
        }
%{ endif ~}
%{ if jwt_do_tag ~}
    tag_jwts_logs:
      type: remap
      inputs:
        - ${jwt_logs_input}
      source: |
        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${jwt_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}
        if would_redact && is_string(.message) && match(string!(.message), jwt_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
  sinks:
    datadog_logs:
      type: datadog_logs
      inputs:
        - ${logs_sink_input}
      default_api_key: $${DATADOG_API_KEY}
      site: ${datadog_site}


And the two JWT transforms:


        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${jwt_services_arr}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}

        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if jwt_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${jwt_services_arr}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}


        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if jwt_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${jwt_services_arr}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}

role: Aggregator
replicas: ${replicas}
podAnnotations:
  reloader.stakater.com/auto: "true"
service:
  enabled: true
  type: ClusterIP
  ports:
    - name: otlp-grpc
      port: 4317
      protocol: TCP
    - name: otlp-http
      port: 4318
      protocol: TCP
    - name: dd-agent
      port: 8282
      protocol: TCP
env:
  - name: DATADOG_API_KEY
    valueFrom:
      secretKeyRef:
        name: vector-datadog
        key: api_key
resources:
  requests:
    cpu: ${requests_cpu}
    memory: ${requests_memory}
  limits:
    cpu: "${limits_cpu}"
    memory: ${limits_memory}
podDisruptionBudget:
  enabled: true
  minAvailable: 2

topologySpreadConstraints:
  - maxSkew: 1
    topologyKey: topology.kubernetes.io/zone
    whenUnsatisfiable: ScheduleAnyway
    labelSelector:
      matchLabels:
        app.kubernetes.io/name: vector

affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          topologyKey: kubernetes.io/hostname
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: vector

%{ if service_monitor_enabled ~}
serviceMonitor:
  enabled: true
%{ endif ~}
customConfig:
  data_dir: /vector-data-dir
  api:
    enabled: true
    address: 0.0.0.0:8686
  sources:
    otlp_in:
      type: opentelemetry
      grpc:
        address: 0.0.0.0:4317
      http:
        address: 0.0.0.0:4318
    dd_agent_in:
      type: datadog_agent
      address: 0.0.0.0:8282
      multiple_outputs: true
      disable_metrics: true
      disable_traces: true
      store_api_key: false
      acknowledgements:
        enabled: true
  transforms:
    drop_audit:
      type: filter
      inputs:
        - otlp_in.logs
        - dd_agent_in.logs
      condition: |
        msg = if is_string(.message) { string!(.message) } else { "" }
        ${audit_drop_condition}
    normalize_logs:
      type: remap
      inputs:
        - drop_audit
      source: |
        if exists(.severity) {
          .status = downcase(to_string!(.severity))
          del(.severity)
        }
%{ if email_do_redact ~}
    redact_emails_logs:
      type: remap
      inputs:
        - normalize_logs
      source: |
        email_re = r'[\w._%+\-]+@[\w.-]+\.[A-Za-z]{2,}'
        if is_string(.message) {
          .message = replace(string!(.message), email_re, "${email_redaction_replacement}")
        }
        if is_object(.attributes) {
          attrs, _err = object(.attributes)
          if is_object(attrs) {
            .attributes = map_values(attrs) -> |v| {
              if is_string(v) { replace(string!(v), email_re, "${email_redaction_replacement}") } else { v }
            }
          }
        }
%{ endif ~}
%{ if email_do_tag ~}
    tag_emails_logs:
      type: remap
      inputs:
        - normalize_logs
      source: |
        email_re = r'[\w._%+\-]+@[\w.-]+\.[A-Za-z]{2,}'
        detected = false
        if is_string(.message) {
          detected = match(string!(.message), email_re)
        }
        if !detected && is_object(.attributes) {
          detected = match(encode_json(.attributes), email_re)
        }
        if detected {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if bearer_do_redact ~}
    redact_bearer_tokens_logs:
      type: remap
      inputs:
        - ${bearer_token_logs_input}
      source: |
        bearer_re = r'(?i)Bearer\s+[A-Za-z0-9+/._~-]+=*'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if bearer_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${bearer_token_services_arr}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${bearer_token_exclusion_condition}
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), bearer_re, "${bearer_token_redaction_replacement}")
        }
%{ endif ~}
%{ if bearer_do_tag ~}
    tag_bearer_tokens_logs:
      type: remap
      inputs:
        - ${bearer_token_logs_input}
      source: |
        bearer_re = r'(?i)Bearer\s+[A-Za-z0-9+/._~-]+=*'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if bearer_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${bearer_token_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${bearer_token_exclusion_condition}
        if would_redact && is_string(.message) && match(string!(.message), bearer_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if aws_key_do_redact ~}
    redact_aws_access_keys_logs:
      type: remap
      inputs:
        - ${aws_key_logs_input}
      source: |
        aws_key_re = r'(AKIA|ASIA|AROA|AIPA|ANPA|ANVA|APKA)[A-Z0-9]{16}'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if aws_key_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${aws_key_services_arr}
        attr_excluded = ${aws_key_attr_exclusion_condition}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${aws_key_string_exclusion_condition} && !attr_excluded
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), aws_key_re, "${aws_access_key_redaction_replacement}")
        }
%{ endif ~}
%{ if aws_key_do_tag ~}
    tag_aws_access_keys_logs:
      type: remap
      inputs:
        - ${aws_key_logs_input}
      source: |
        aws_key_re = r'(AKIA|ASIA|AROA|AIPA|ANPA|ANVA|APKA)[A-Z0-9]{16}'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if aws_key_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${aws_key_services_arr}
        attr_excluded = ${aws_key_attr_exclusion_condition}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${aws_key_string_exclusion_condition} && !attr_excluded
        if would_redact && is_string(.message) && match(string!(.message), aws_key_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if jwt_do_redact ~}
    redact_jwts_logs:
      type: remap
      inputs:
        - ${jwt_logs_input}
      source: |
        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${jwt_services_arr}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), jwt_re, "${jwt_redaction_replacement}")
        }
%{ endif ~}
%{ if jwt_do_tag ~}
    tag_jwts_logs:
      type: remap
      inputs:
        - ${jwt_logs_input}
      source: |
        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${jwt_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}
        if would_redact && is_string(.message) && match(string!(.message), jwt_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
  sinks:
    datadog_logs:
      type: datadog_logs
      inputs:
        - ${logs_sink_input}
      default_api_key: $${DATADOG_API_KEY}
      site: ${datadog_site}


        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${jwt_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}

        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if jwt_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${jwt_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}


        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if jwt_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${jwt_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}

role: Aggregator
replicas: ${replicas}
podAnnotations:
  reloader.stakater.com/auto: "true"
service:
  enabled: true
  type: ClusterIP
  ports:
    - name: otlp-grpc
      port: 4317
      protocol: TCP
    - name: otlp-http
      port: 4318
      protocol: TCP
    - name: dd-agent
      port: 8282
      protocol: TCP
env:
  - name: DATADOG_API_KEY
    valueFrom:
      secretKeyRef:
        name: vector-datadog
        key: api_key
resources:
  requests:
    cpu: ${requests_cpu}
    memory: ${requests_memory}
  limits:
    cpu: "${limits_cpu}"
    memory: ${limits_memory}
podDisruptionBudget:
  enabled: true
  minAvailable: 2

topologySpreadConstraints:
  - maxSkew: 1
    topologyKey: topology.kubernetes.io/zone
    whenUnsatisfiable: ScheduleAnyway
    labelSelector:
      matchLabels:
        app.kubernetes.io/name: vector

affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          topologyKey: kubernetes.io/hostname
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: vector

%{ if service_monitor_enabled ~}
serviceMonitor:
  enabled: true
%{ endif ~}
customConfig:
  data_dir: /vector-data-dir
  api:
    enabled: true
    address: 0.0.0.0:8686
  sources:
    otlp_in:
      type: opentelemetry
      grpc:
        address: 0.0.0.0:4317
      http:
        address: 0.0.0.0:4318
    dd_agent_in:
      type: datadog_agent
      address: 0.0.0.0:8282
      multiple_outputs: true
      disable_metrics: true
      disable_traces: true
      store_api_key: false
      acknowledgements:
        enabled: true
  transforms:
    drop_audit:
      type: filter
      inputs:
        - otlp_in.logs
        - dd_agent_in.logs
      condition: |
        msg = if is_string(.message) { string!(.message) } else { "" }
        ${audit_drop_condition}
    normalize_logs:
      type: remap
      inputs:
        - drop_audit
      source: |
        if exists(.severity) {
          .status = downcase(to_string!(.severity))
          del(.severity)
        }
%{ if email_do_redact ~}
    redact_emails_logs:
      type: remap
      inputs:
        - normalize_logs
      source: |
        email_re = r'[\w._%+\-]+@[\w.-]+\.[A-Za-z]{2,}'
        if is_string(.message) {
          .message = replace(string!(.message), email_re, "${email_redaction_replacement}")
        }
        if is_object(.attributes) {
          attrs, _err = object(.attributes)
          if is_object(attrs) {
            .attributes = map_values(attrs) -> |v| {
              if is_string(v) { replace(string!(v), email_re, "${email_redaction_replacement}") } else { v }
            }
          }
        }
%{ endif ~}
%{ if email_do_tag ~}
    tag_emails_logs:
      type: remap
      inputs:
        - normalize_logs
      source: |
        email_re = r'[\w._%+\-]+@[\w.-]+\.[A-Za-z]{2,}'
        detected = false
        if is_string(.message) {
          detected = match(string!(.message), email_re)
        }
        if !detected && is_object(.attributes) {
          detected = match(encode_json(.attributes), email_re)
        }
        if detected {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if bearer_do_redact ~}
    redact_bearer_tokens_logs:
      type: remap
      inputs:
        - ${bearer_token_logs_input}
      source: |
        bearer_re = r'(?i)Bearer\s+[A-Za-z0-9+/._~-]+=*'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if bearer_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${bearer_token_services_arr}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${bearer_token_exclusion_condition}
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), bearer_re, "${bearer_token_redaction_replacement}")
        }
%{ endif ~}
%{ if bearer_do_tag ~}
    tag_bearer_tokens_logs:
      type: remap
      inputs:
        - ${bearer_token_logs_input}
      source: |
        bearer_re = r'(?i)Bearer\s+[A-Za-z0-9+/._~-]+=*'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if bearer_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${bearer_token_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${bearer_token_exclusion_condition}
        if would_redact && is_string(.message) && match(string!(.message), bearer_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if aws_key_do_redact ~}
    redact_aws_access_keys_logs:
      type: remap
      inputs:
        - ${aws_key_logs_input}
      source: |
        aws_key_re = r'(AKIA|ASIA|AROA|AIPA|ANPA|ANVA|APKA)[A-Z0-9]{16}'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if aws_key_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${aws_key_services_arr}
        attr_excluded = ${aws_key_attr_exclusion_condition}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${aws_key_string_exclusion_condition} && !attr_excluded
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), aws_key_re, "${aws_access_key_redaction_replacement}")
        }
%{ endif ~}
%{ if aws_key_do_tag ~}
    tag_aws_access_keys_logs:
      type: remap
      inputs:
        - ${aws_key_logs_input}
      source: |
        aws_key_re = r'(AKIA|ASIA|AROA|AIPA|ANPA|ANVA|APKA)[A-Z0-9]{16}'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if aws_key_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${aws_key_services_arr}
        attr_excluded = ${aws_key_attr_exclusion_condition}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${aws_key_string_exclusion_condition} && !attr_excluded
        if would_redact && is_string(.message) && match(string!(.message), aws_key_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
%{ if jwt_do_redact ~}
    redact_jwts_logs:
      type: remap
      inputs:
        - ${jwt_logs_input}
      source: |
        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
%{ if jwt_needs_combined ~}
        combined = msg + " " + ddtags
%{ endif ~}
        target_services = ${jwt_services_arr}
        should_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}
        if should_redact && is_string(.message) {
          .message = replace(string!(.message), jwt_re, "${jwt_redaction_replacement}")
        }
%{ endif ~}
%{ if jwt_do_tag ~}
    tag_jwts_logs:
      type: remap
      inputs:
        - ${jwt_logs_input}
      source: |
        jwt_re = r'eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'
        svc = to_string(.service) ?? ""
        ddtags = to_string(.ddtags) ?? ""
        msg = if is_string(.message) { string!(.message) } else { "" }
        combined = msg + " " + ddtags
        target_services = ${jwt_services_arr}
        would_redact = contains(ddtags, "env:prod") && includes(target_services, svc) && ${jwt_exclusion_condition}
        if would_redact && is_string(.message) && match(string!(.message), jwt_re) {
          .ddtags = if is_string(.ddtags) { string!(.ddtags) + ",vector_redaction:true" } else { "vector_redaction:true" }
        }
%{ endif ~}
  sinks:
    datadog_logs:
      type: datadog_logs
      inputs:
        - ${logs_sink_input}
      default_api_key: $${DATADOG_API_KEY}
      site: ${datadog_site}


Let me do a quick sanity check that no bare `combined` assignments remain:


Bash

Verify all combined assignments are now guarded


143:%{ if bearer_needs_combined ~}
144:        combined = msg + " " + ddtags
162:%{ if bearer_needs_combined ~}
163:        combined = msg + " " + ddtags
181:%{ if aws_key_needs_combined ~}
182:        combined = msg + " " + ddtags
201:%{ if aws_key_needs_combined ~}
202:        combined = msg + " " + ddtags
221:%{ if jwt_needs_combined ~}
222:        combined = msg + " " + ddtags
240:%{ if jwt_needs_combined ~}
241:        combined = msg + " " + ddtags


All 6 occurrences are guarded. The fix: `combined` is now only emitted in the VRL source when there are actually exclusion patterns that reference it. When no patterns are configured (as in your current deployment), the variable is omitted entirely and the warning disappears.

The same fix was applied preemptively to the bearer token and JWT transforms to avoid the identical warning appearing if those scanners are ever enabled in dry-run mode without exclusion patterns.


afplay ~/.claude/sounds/mario/stop/stomp.wav 2>/dev/null || true


<command-message>obsidian-save</command-message>
<command-name>/obsidian-save</command-name>


Save current conversation context to an Obsidian note under the `Claude/` directory.

## What to save

Capture all of the following that are relevant to the current conversation:

- **Conversation summary**: What the user is trying to accomplish and why
- **Project context**: Relevant architecture, design decisions, or constraints discovered
- **Task state**: What has been completed, what is in progress, what is blocked or pending
- **Key decisions**: Any choices made and the reasoning behind them
- **Open questions**: Unresolved questions or things to revisit
- **Next steps**: Concrete actions that should follow from this session

## File location

Derive the project name from the current working directory (use the repo or app folder name). Save to:

```
Claude/<project-name>/<YYYY-MM-DD>-<short-slug>.md
```

Use today's date and a short 2-4 word slug describing the session topic (e.g. `2026-04-29-ruth-plugin-setup.md`).

If `` is provided, use it as the slug instead of generating one.

## Note format

Use this structure:

```markdown
---
date: <YYYY-MM-DD>
project: <project-name>
tags: [claude-context]
---

# <Session Title>

## Summary
<1-3 sentence overview of what this session was about>

## Context
<Relevant project background, architecture notes, constraints>

## Decisions
<Decisions made and rationale>

## Task State
<What was completed, in progress, or blocked>

## Open Questions
<Anything unresolved>

## Next Steps
<Concrete follow-up actions>
```

## Steps

1. Determine the project name from the working directory.
2. Determine today's date.
3. Draft the note content based on the current conversation.
4. Use `mcp__obsidian__create_vault_file` to write the note to the vault.
5. Confirm to the user where the note was saved.


---
date: 2026-05-12
project: vector
tags: [claude-context]
---

# VRL Unused Variable Warning Fix

## Summary
Fixed a VRL compilation warning in the Vector Helm module where `combined` was assigned but never referenced when no exclusion patterns were configured. Applied the fix consistently across all three scanner transforms (bearer token, AWS access key, JWT).

## Context
- Repo: `operations/terraform/internal-modules/kubernetes/monitoring/vector`
- Branch: `SRE-2806-fix-sysdig-ref`
- The Vector module generates a Helm values file via `templatefile()` from `templates/values.yaml.tpl`
- Each scanner transform (bearer token, AWS access key, JWT) has redact and tag variants
- Exclusion patterns allow skipping redaction for specific strings; when present, they reference a `combined` VRL variable (`msg + " " + ddtags`)
- When no exclusion patterns are configured, the `*_exclusion_condition` Terraform local renders to the literal string `"true"`, meaning `combined` is assigned in VRL but never referenced → VRL emits `warning[E900]: unused variable 'combined'`

## Decisions
- Added three boolean locals to `main.tf` (`bearer_needs_combined`, `aws_key_needs_combined`, `jwt_needs_combined`) each set to `length(var.*_exclusion_patterns) > 0`
- Passed those booleans to the `templatefile()` call
- Wrapped all 6 `combined = msg + " " + ddtags` lines in `%{ if *_needs_combined ~}` / `%{ endif ~}` conditionals in the template
- Fixed all three scanner types proactively, not just the one currently warning

## Task State
- [x] Root cause identified
- [x] `main.tf` updated with three new locals and templatefile args
- [x] `templates/values.yaml.tpl` updated — all 6 `combined` assignments now conditional
- [ ] `terraform apply` / Helm rollout not yet verified (requires cluster access)

## Open Questions
- None — the fix is straightforward and low-risk

## Next Steps
- Deploy the change to a cluster running in dry-run mode to confirm the warning is gone
- Consider bumping the module version after the fix lands


File created successfully

File created successfully


Saved to `Claude/vector/2026-05-12-vrl-unused-variable-fix.md`, Sir Charles of St Cheese.


<local-command-caveat>Caveat: The messages below were generated by the user while running local commands. DO NOT respond to these messages or otherwise consider them in your response unless the user explicitly asks you to.</local-command-caveat>


<command-name>/exit</command-name>
            <command-message>exit</command-message>
            <command-args></command-args>


<local-command-stdout>See ya!</local-command-stdout>