How to Redact PII Labels and Bearer Exemplars from Prometheus OpenMetrics Dumps Without Breaking Cardinality

Описание и применение

С помощью браузерного инструмента Prometheus Metrics Label Redactor можно безопасно удалять PII и токены из дампов OpenMetrics, сохраняя кардинальность метрик и избегая ошибок дублирования при повторном импорте.

Задача

When a Kubernetes cluster experiences a cardinality explosion or histogram latency spike, SREs need to inspect raw Prometheus/OpenMetrics dumps, but naive regex redaction collapses distinct time series and breaks ingestion.

Результат

Using the browser-based redactor, sensitive data is removed while preserving metric cardinality, enabling safe sharing of diagnostic dumps without ingestion failures.

Рабочий процесс

• 1. Run curl -s http://localhost:9090/metrics > scrape_dump.prom to capture dump.
• 2. Open the dump in the Prometheus Metrics Label Redactor web tool.
• 3. Choose a scrubbing level (35%, 70%, or 95%).
• 4. The tool applies deterministic FNV-1a hashing to labels and optional exemplar/token scrubbing.
• 5. Export the redacted dump and load it into Promtool, VictoriaMetrics, or a local Prometheus instance without errors.

Доказательства

If you run a naive regex script that replaces every sensitive email or IP with a static [REDACTED] string, multiple distinct time series collapse into identical label sets.

Источник

Deterministic FNV-1a Label Hashing: Maps [email protected] to a consistent pseudonym ([email protected]) across every counter, gauge, and histogram bucket so time-series cardinality remains 100% intact.

Источник

100% Local Browser RAM Execution: Zero network egress. Your /metrics dump never leaves your laptop.

Источник