Configuration Reference¶

This is the exhaustive, per-key reference for tailscale2otel configuration. It is the companion to two other docs:

• config.example.yaml — a commented starter showing the common knobs. The fastest way to get started.
• docs/metrics.md — every metric and log signal the exporter emits (and the OTLP→Prometheus name normalization you query in Grafana Cloud).

Use this page when you need the precise meaning, default, valid values, and gotchas of a specific setting.

This file is hand-maintained (unlike docs/metrics.md, which is generated). If you change the config schema in internal/config/, update this page too.

Layered configuration¶

Configuration is loaded in three layers, lowest precedence first:

1. Built-in defaults — the exporter runs without a config file; any key you do not set keeps its default (defined in internal/config/defaults.go).
2. YAML file (optional) — pass -config path/to/file.yaml; the file overrides defaults for any key it mentions. A non-existent path passed with -config is an error; omitting -config entirely is not.
3. Environment variables — highest precedence; override both defaults and the file.

Environment-variable convention¶

Every config field is settable via an environment variable:

• Prefix: TS2OTEL_
• Nesting delimiter: __ (double underscore) between levels
• Within a name: single underscores are preserved (e.g. client_id stays CLIENT_ID)

For the complete, generated list of every TS2OTEL_* variable with its default and description, see env-vars.md. The samples below just illustrate the rule.

Mapping examples¶

Scalar lists¶

Fields whose type is a list of strings accept a comma-separated value as an env var. Examples:

TS2OTEL_TAILSCALE__AUTH__OAUTH__SCOPES=all:read,log_streaming
TS2OTEL_COLLECTORS__NODE_METRICS__METRIC_ALLOW=tailscaled_inbound.*,tailscaled_outbound.*
TS2OTEL_COLLECTORS__NODE_METRICS__DROP_LABELS=job,prometheus_replica
TS2OTEL_COLLECTORS__NODE_METRICS__DISCOVERY__INCLUDE_TAGS=tag:server,tag:relay
TS2OTEL_COLLECTORS__DEVICES__ATTRIBUTE_NAMESPACES=intune,jamf,ip

File-only fields¶

These fields cannot be set via flat env vars because they are maps or lists of structs:

• otlp.headers — use the YAML file (or use otlp.grafana_cloud for Grafana Cloud).
• collectors.node_metrics.targets — each target is a struct; static targets require a YAML file.
• profiling.pyroscope.tags — a string→string map; set via YAML.

Unknown-variable advisory¶

A TS2OTEL_* env var that does not match any known config key is logged at startup as a WARN — this almost always means a typo in the variable name. The exporter still starts; the variable is ignored.

Conventions¶

• Default is the value used when the key is not set in either the file or an env var.
• Durations use Go's syntax: 500ms, 30s, 5m, 1h, 168h (= 7 days).
• Validation — invalid enum values and inconsistent combinations are rejected at startup by Config.Validate() (the exporter refuses to start). Softer issues are surfaced as startup WARN advisories by Config.Warnings() but do not block startup. Both are noted below.

Contents¶

• Top level
• headscale — Headscale control-plane connection
• tailscale — API connection & authentication
• tailnets — multi-tailnet / MSP mode
• otlp — the OTLP exporter
• enrichment — device-name cache
• cardinality — metric/label cardinality controls
• collectors — per-source polling
• checkpoint — poll high-water marks
• streaming — Splunk-HEC log receiver
• webhook — event webhook receiver
• self_observability — the exporter's own telemetry
• pii_filter — PII / identifier redaction
• admin — admin HTTP server (probes + status page)
• prometheus — Prometheus pull endpoint
• profiling — pprof & Pyroscope
• version_checks — outbound "is a newer release available?" checks
• tracing — OTEL traces pillar

Top level¶

headscale — Headscale control-plane connection¶

Used only when provider: headscale. Auth is a Bearer API key; keep it in an environment variable (TS2OTEL_HEADSCALE__API_KEY), not in the YAML file.

Under provider: headscale only the devices, users, keys, acl, and nodemetrics collectors run. The Tailscale-only collectors (flowlogs, auditlogs, services, webhooks, contacts, posture_integrations, log_stream, oauth_apps, settings, dns) auto-disable; enabling them explicitly triggers a startup warning.

Reduced device signal set. Headscale's API exposes fewer device fields than Tailscale, so under provider: headscale the devices collector emits a subset of its usual signals — online status, advertised/enabled routes (exit-node and subnet-router derivations still work), key expiry, last-seen, and tag/user counts. Two booleans that Tailscale devices carry with no Headscale equivalent are defaulted to the only value that could ever be correct, rather than treated as missing: authorized (every node Headscale returns is registered, hence authorized, by definition) and external (Headscale has no device-sharing feature, so no node it returns can ever be "external"). By contrast, the following are genuine no-data gaps — the source fields are absent, so the affected signals are not emitted at all rather than reporting a fabricated zero/false: per-DERP-region latency, posture and posture attributes, tailnet-lock, tailscale.device.update_available, tailscale.devices.ephemeral, OS/version distribution, and connectivity quality. Likewise device share-invites and user-invites are unavailable.

Reduced user signal set. Headscale's user API has no per-user device-count or connection-state concept, so tailscale.user.devices and tailscale.user.connected are not emitted under provider: headscale (rather than reporting a fabricated 0/not-connected). tailscale.user.last_seen and the aggregate tailscale.users.count are unaffected.

Spent one-time pre-auth keys. Headscale reports whether a non-reusable pre-auth key has already been redeemed (used). A used one-time key is mapped to the same "invalid" state Tailscale's API uses for a dead/revoked key, so it stops reporting a live tailscale.key.expiry gauge and can no longer trigger the tailscale.key.expiring warning. Reusable keys are unaffected by use.

Headscale server metrics. Headscale also exposes its own Prometheus endpoint (the control-plane server, default :9090) — distinct from per-node tailscaled :5252. Scrape it by adding it as a static node_metrics target (see the node_metrics section); there is no dedicated knob for it.

tailscale — API connection & authentication¶

tailscale.auth¶

Prefer OAuth: its tokens are short-lived, auto-refreshing, and not bound to a user.

WARN (advisory): method: apikey triggers a startup warning — a personal API key expires in ≤90 days and stops working when the user who created it is suspended or removed. For an unattended exporter, prefer method: oauth.

tailscale.http¶

The HTTP client used for all Tailscale API calls.

Token fetches use the same timeout, end-to-end. tailscale.http.timeout also bounds each OAuth client-credentials refresh and workload-identity token exchange — but there it covers the whole call (connect + headers + body read) with no retries and no backoff, unlike a normal API call where it bounds one attempt and max_attempts governs the retry chain. A token endpoint that sends valid headers and then stalls mid-body therefore fails within this timeout instead of hanging the refresh — and every collector queued behind that single shared refresh — indefinitely.

Tune tailscale.http.timeout together with flowlogs/auditlogs max_window. After an outage, the next poll tick fetches and decodes a catch-up window as large as max_window in a single request. If streaming and decoding that much log data takes longer than tailscale.http.timeout, every attempt at that window fails identically (the checkpoint never advances — see the max_window field below) — a durable wedge that only clears with a config change or a smaller subsequent window. There is currently no automatic shrink-on-timeout: raise tailscale.http.timeout to comfortably cover decoding the largest configured max_window for your tailnet's flow/audit log volume, or lower max_window so a worst-case catch-up window reliably completes within the timeout.

Multi-tailnet: the tailscale.http block is the fleet-wide default for every tailnets[] entry. Each entry's http: fields are backfilled field-by-field with the precedence entry > tailscale.http > built-in defaults, so an entry that omits http: still gets real retry/timeout defaults (a zero max_attempts would otherwise disable retries entirely), and setting a value once on tailscale.http — including via TS2OTEL_TAILSCALE__HTTP__* env vars — applies it to the whole list. An entry that sets its own http: field overrides the fleet default for that field only.

tailnets — multi-tailnet / MSP mode¶

Optional list for observing more than one tailnet from a single instance (e.g. an MSP watching several customer tailnets). Empty by default — an empty (or absent) tailnets: means the ordinary single-tailnet tailscale: block above is used instead.

Mutual exclusion with tailscale.tailnet. tailnets: and an explicit tailscale.tailnet cannot both be set — a non-empty tailnets list alongside a tailscale.tailnet that names an actual tailnet is rejected at startup (the default "-" sentinel does not count as a conflict, since it's just "no explicit override"). Use one or the other, never both.

No inheritance of tailscale.* auth defaults. Every tailnets[] entry needs its own name and auth — credentials are never inherited from the top-level tailscale.auth block (http is the one exception; see above). An oauth entry that omits scopes still gets the least-privilege default used everywhere else in this exporter: ["all:read"] — never an unscoped token covering every scope the OAuth client holds.

streaming/webhook are single-tailnet only. Both receivers feed shared processors and one enrichment cache, so more than one tailnets[] entry combined with streaming.enabled: true or webhook.enabled: true is rejected at startup. Use source: poll on flowlogs/auditlogs in multi-tailnet mode instead (source: stream is likewise rejected for the same reason).

Checkpoint namespacing. Poll checkpoint keys are <name> (collector name only) in single-tailnet mode and <tailnet>/<name> in multi-tailnet mode. Switching between single- and multi-tailnet mode, or renaming/removing a tailnet, changes the key shape; the exporter migrates a matching legacy key automatically when exactly one unambiguous candidate exists, and otherwise leaves the stale key in the checkpoint file (logged) while the affected collector cold-starts from initial_lookback.

Telemetry identity. Each tailnet gets its own service.instance.id (and thus its own target_info/Prometheus instance) plus the tailscale.tailnet resource attribute, so series from different tailnets never collide on the OTLP push path; query fleet-wide with sum without(instance)(...). On the prometheus pull endpoint, tailscale_tailnet is the label that keeps per-tailnet series distinct at the shared /metrics port — see the note in that section.

otlp — the OTLP exporter¶

The single egress path for metrics and logs. internal/telemetry is the only component that touches OTLP.

otlp.grafana_cloud¶

Convenience for Grafana Cloud: when both are set, an Authorization: Basic <base64(instance:token)> header is built for you (no need to hand-craft it in otlp.headers).

otlp.tls¶

Transport security for grpc/http.

insecure vs insecure_skip_verify. otlp.tls.insecure disables TLS entirely (plaintext h2c / http://) — it is NOT a certificate-verify skip, and it sends any Authorization: Basic Grafana Cloud credential unencrypted. To reach an internal OTLP gateway with a self-signed / private-CA certificate over TLS, either add its CA to otlp.tls.ca_file (preferred) or set otlp.tls.insecure_skip_verify: true to keep TLS on while skipping verification (testing only — vulnerable to MITM).

enrichment — device-name cache¶

The in-memory IP/nodeID→name cache, populated by the devices collector and used to enrich flow and audit records.

Enrichment depends on the devices collector. If devices is disabled, flow/audit IP→name resolution silently degrades to unknown/external.

enrichment.reverse_dns¶

Optional async reverse-DNS (PTR) enrichment of external (non-Tailscale) flow addresses. Off by default. When enabled, resolved hostnames replace the external bucket / raw IP in tailscale.src.node / tailscale.dst.node on flow logs and metrics. Lookups are async and cached; the hot path never blocks.

A cache "miss" does not always schedule a resolution. The tailscale.rdns.cache.lookups metric's miss result covers every sighting that isn't a cached hit or cached negative — but a background resolution is only actually scheduled when the address isn't already in flight and the cache/worker pool has capacity. A repeat sighting of an address whose resolution is already pending, or one that arrives while the cache/worker pool is at capacity, still counts as a miss without issuing a new query. Don't alert on "misses without a matching query" as a resolver-health signal — that gap is expected under normal load, not a fault.

cardinality — metric/label cardinality controls¶

These knobs trade detail for active-series count. They apply to the shared processors, so they take effect no matter whether logs arrive by poll or by stream.

Top-level cardinality keys¶

cardinality.flow — flow metric shaping¶

These knobs affect flow metrics only. Flow logs always carry full detail regardless.

cardinality.per_entity — per-entity gauge gates¶

When a toggle is false, only the low-cardinality aggregate *.count rollup is emitted; the per-entity gauge series (one per device/user/key/…) are dropped. All default true.

collectors — per-source polling¶

Each collector has at least enabled and interval. The two log collectors (flowlogs, auditlogs) additionally have source and a set of windowing fields; the rest are point-in-time snapshots.

Common fields¶

source and the windowing fields (flowlogs / auditlogs only)¶

source selects how the log collector obtains data:

• poll (default) — the exporter pulls logs from the Tailscale API on interval, one time-window per tick.
• stream — logs are pushed to the streaming receiver instead; the exporter does not poll this log type.
• both — poll and accept the stream. Discouraged: the same record can be double-counted. Cross-source de-duplication is a best-effort failsafe, not a guarantee, and a startup WARN fires.

Pick exactly one method per log type. Which fields are honored depends on source:

¹ Under poll the budget is shared across the whole poll window; under stream it is applied per received record. Either way, metrics are never capped — only logs.

The four windowing fields exist purely to drive the poller, so they are ignored when source: stream. The streaming/webhook receivers and the pollers feed the same processors, which is why log_mode and the cardinality.* knobs apply on every path.

source: stream requires a live ingestion path. It is rejected at startup unless streaming.enabled: true, and it is not supported in multi-tailnet mode (streaming receivers are single-tailnet only) — otherwise the collector would have no way to receive records and would silently ingest nothing. Use source: poll (the default) or both when the receiver is off.

collectors.devices¶

collectors.flowlogs¶

Network flow logs → aggregated traffic counters + per-connection flow logs.

collectors.auditlogs¶

Configuration/audit events → event logs + a counter.

Snapshot collectors¶

collectors.services¶

collectors.node_metrics¶

Optional scraper that pulls tailscaled per-node Prometheus /metrics and forwards them centrally over OTLP (counters as deltas, gauges as gauges, plus a per-target tailscale.node.up). Off by default, and inert unless it has at least one static target or discovery enabled. Node identity is carried as the tailscale.node label (Prometheus: tailscale_node), not an OTEL Resource and deliberately not instance — Grafana Cloud's OTLP→Prometheus translation promotes the resource attribute service.instance.id to the instance label, and that would clobber a per-series instance attribute and collapse tailscale.node.up to one series. See docs/node-metrics.md for the operator how-to.

These filters apply only to forwarded samples — never to tailscale.node.up or the discovery.* gauges.

Source-series identity vs. emitted labels. Cumulative counters are forwarded as deltas, and each delta baseline is keyed off the complete scraped source series — its metric name, every raw label (before drop_labels and before any curated folding), and the target's stable identity (normalized URL + node-identity label). So two source series that collapse onto one emitted series — because drop_labels removed a distinguishing label, or a curated mapping folds one — keep separate baselines (and separate first-observation suppression and reset detection), and their individually-correct deltas sum on the merged output. Distinct targets never share a baseline even when they scrape identical series.

Duplicate targets are rejected. Two static targets[] that resolve to the same effective identity (same normalized URL and same instance/node label) are a startup config error — such a pair would scrape one endpoint twice under one identity and corrupt each other's baselines. Targets that differ only by URL, or only by instance, are fine (e.g. a verify-on and a skip-verify scrape of the same URL, labeled distinctly). Discovered targets remain deduped against the static set by URL (static wins), and any residual same-identity duplicate at runtime is collapsed deterministically.

collectors.node_metrics.targets[]¶

A static list of endpoints to scrape (keys below are relative to each list entry). Native tailscaled endpoints are plain HTTP and need no auth/TLS; the optional fields cover proxied/HTTPS targets.

collectors.node_metrics.discovery¶

Discover scrape targets dynamically from the Tailscale devices API (keys below are relative to the discovery block). Discovered targets are unioned (deduped by URL, static wins) with the static targets, on this block's own interval.

checkpoint — poll high-water marks¶

Checkpoints record how far each polled log collector (flowlogs/auditlogs with source: poll or both) has read, so a restart resumes without gaps or large overlaps. The store is unused if you stream both log types or disable them.

• file (default) — the high-water mark is persisted to file_path with an atomic write on each tick and reloaded at startup, so polling resumes from the exact high-water mark across restarts (minor boundary overlap is de-duplicated). For the checkpoint to actually survive a restart, mount a writable, persistent path at the file's directory (a volume in Kubernetes/Docker). If the path is not writable (e.g. a read-only root filesystem with no volume, or a local run without access to /var/lib), the exporter logs a WARN and transparently falls back to memory rather than erroring.
• memory — the high-water mark lives in RAM only and is lost on restart. After a restart the poller cold-starts from initial_lookback, so any downtime longer than initial_lookback leaves a gap. Needs no volume; fine for streamed or stateless deployments where the checkpoint is unused or disposable.

streaming — Splunk-HEC log receiver¶

Optional receiver for Tailscale's log streaming (a Splunk-HEC sink). When you enable it, set the relevant log collector(s) to source: stream so each log type is ingested by exactly one path. Off by default.

Validation: auto_configure: true errors at startup unless both streaming.enabled: true and a non-empty streaming.public_url are set. Running the poller and this receiver for the same log type triggers a dual-ingestion WARN.

Batch delivery is all-or-nothing. The receiver parses and type-checks a whole POST before routing a single record, so a request is never acknowledged 200 after silently dropping part of its payload. A structurally corrupt/truncated body (rejected{reason=malformed}) or a record that classifies as a known type but fails typed decoding (rejected{reason=decode_error}, e.g. after an unhandled wire-format change) rejects the whole request with a 4xx and emits nothing, so the sender retries rather than treating the loss as delivered. A record whose type is not recognised at all stays forward-compatible: it is skipped and counted (skipped) and the batch still succeeds. This replaces the earlier valid-prefix salvage — salvaging a truncated batch and ACKing it 200 was itself a durability hole.

webhook — event webhook receiver¶

Optional receiver for real-time Tailscale events (HMAC-verified). Off by default.

self_observability — the exporter's own telemetry¶

pii_filter — PII / identifier redaction¶

Runtime opt-out toggles for each identifier category. All 13 categories default to true (identifiers are emitted as-is). Set a category to false to drop those identifiers from metrics and logs at collection time. Gauges whose only meaningful identity is a redacted category are suppressed entirely. Categories are independent — you can redact external IPs while keeping Tailscale IPs, for example.

Note: these toggles gate emission only — they do not encrypt or hash values. Setting a category to false simply omits that class of identifier from emitted telemetry entirely.

host:port values are classified by their address, not their string shape. Some IP-valued attributes — notably the node-metrics identity default tailscale.node — can appear as host:port (100.64.0.1:5252) or bracketed IPv6 ([fd7a:115c:a1e0::1]:5252). These are classified by the address portion alone, so they are gated by the matching tailscale_ips / internal_ips / external_ips toggle — never by hostnames. A value that merely looks like host:port but whose host segment is not a parseable IP (a genuine hostname such as laptop-1:5252) still falls back to hostnames, unchanged.

The filter covers log message bodies too, not only attributes. A disabled category's identifiers are removed from log record bodies as well as from metric labels and log attributes — so an operator who turns a category off does not get it leaked back through the human-readable body. Two shapes of body are handled:

• Standalone free-text bodies — a raw upstream message or error whose whole content is free text (tailscale.webhook.*, tailscale.device.tailnet_lock_error, tailscale.logstream.error). When pii_filter.free_text_details is false the body is replaced entirely with [redacted]; the generic event name, severity, and low-cardinality attributes still convey what happened.
• Mixed bodies — a body that embeds an identifier which is also carried as an attribute (flow addresses on tailscale.network.flow, the key description on tailscale.key.expiring, the app name on tailscale.oauth_app.info). Only the disabled-category value is masked, in place, wherever it appears; the non-PII structure (transport, byte counts, scope counts, …) is preserved. A flow body's Tailscale source address, for example, is masked when tailscale_ips is false but kept when it is true, independent of the hostnames toggle.

When every category is enabled (the default) bodies are byte-identical to before — redaction only engages once a category is turned off. A handful of bodies are generic by construction and so are never affected: tailscale.acl.risky_rule ("Unrestricted ACL rule in section %q" — the rule text lives only in the tailscale.acl.rule attribute) and tailscale.key.scopes ("Tailscale key (%s) has %d scope(s)" — the description lives only in the tailscale.key.description attribute); both attributes are still gated by pii_filter.free_text_details. (tailscale.audit.details is an unrelated audit-log attribute.)

admin — admin HTTP server (probes + status page)¶

Always-off-by-default HTTP server exposing liveness/readiness probes plus an optional status page. The status page surfaces operational metadata (collector health, cardinality, discovered nodes, redacted config) but never secret values. Bind it to a tailnet/loopback address, not the public internet.

WARN (advisory): if landing_page is served on a wildcard (all-interfaces) bind with no admin.auth.token, a startup warning fires — the page exposes internal state to anyone who can reach the port. Set a token or bind to loopback/tailnet.

prometheus — Prometheus pull endpoint¶

An opt-in, off-by-default GET /metrics endpoint on a dedicated listener (prometheus.listen, default :2112). When enabled it attaches an additional metric.Reader (a per-provider Prometheus registry) alongside the OTLP push path, so both export paths are active at once — Prometheus scraping and OTLP push are independent and complementary; enabling one does not disable the other.

The endpoint is fully separate from the admin server (admin.listen) and must bind to a different address. It serves only GET /metrics; no status page or probes are exposed here.

Multi-tailnet: each tailnet's metrics carry a tailscale_tailnet="<name>" data-point label that keeps multi-tailnet series distinct at a shared /metrics endpoint. This label is what prevents a collision, so disabling pii_filter.tailnet_name removes it and the per-tailnet series collapse (the endpoint uses first-wins and still returns 200 rather than a 500 — see the pii_filter.tailnet_name note above). A target_info info metric is also emitted per provider. On Grafana Cloud the primary metrics path is OTLP (which uses the target_info join for resource attributes); the Prometheus endpoint is an additional pull-compatible path for existing Prometheus-only infrastructure. Per-tailnet identity (tailscale.tailnet, tailscale2otel.provider) is a signal-scoped metric/log/trace attribute rather than a resource attribute, so it needs no target_info join on either export path.

WARN (advisory): if prometheus.enabled is true on a wildcard bind (empty host, e.g. :2112) with no prometheus.auth.token, a startup warning fires — the endpoint exposes every series (including device hostnames, flow identifiers, and tailnet name) to anyone who can reach the port. Set a token or bind to loopback/tailnet.

Validation: every enabled HTTP listener — admin.listen, prometheus.listen, streaming.listen, and webhook.listen — must bind a distinct address. If any two enabled servers share an address the exporter errors at startup (otherwise only one would win the net.Listen race and the other would die silently).

Prometheus scrape_configs snippet¶

scrape_configs:
  - job_name: tailscale2otel
    static_configs:
      - targets: ["host:2112"]
    # If prometheus.auth.token is set:
    authorization:
      credentials: "<token>"

profiling — pprof & Pyroscope¶

Optional continuous/on-demand profiling. Everything here is off by default and carries no Tailscale data. The pprof handlers mount on the admin server.

Validation / advisories: - pprof.enabled errors at startup unless admin.enabled: true and admin.auth.token is set (heap/goroutine dumps can expose in-memory secrets, so pprof must not be served unauthenticated). - pyroscope.enabled errors at startup without pyroscope.server_address. - A grafana.net server_address with an empty basic_auth_password triggers a WARN — Grafana Cloud Profiles requires the Basic-auth credentials. - When enabled, Pyroscope pushes the full profile set: CPU, memory (alloc/inuse), goroutines, mutex/block contention, and goroutine-leak. Goroutine-leak relies on the Go goroutineleakprofile runtime experiment, which the release binaries and container image are built with (GOEXPERIMENT=goroutineleakprofile); a binary built without it silently omits that one profile type. The mutex/block sampling rates above are applied only when a consumer (pprof or pyroscope) is enabled.

version_checks — outbound "is a newer release available?" checks¶

Optional outbound checks that compare the running build / device client versions against the latest releases. Both sub-checks make external HTTPS calls and are fail-open (a failed or blocked fetch silently emits nothing, never errors). Disable both for air-gapped deployments.

Advisories: - version_checks.devices.enabled=true with collectors.devices.enabled=false triggers a WARN — the per-device version-skew metrics need the devices collector to run.

tracing — OTEL traces pillar¶

Optional OTEL traces pillar. Off by default. When enabled, the exporter emits spans for its own internal work — reusing otlp.* for the endpoint/protocol/headers/TLS (no separate trace endpoint). When tracing.enabled is true, the metric exemplar filter also flips to trace-based, so the tailscale2otel.api.duration latency histogram carries trace exemplars that link directly to the corresponding API request span.

Advisories: - tracing.enabled=true with sampler_arg=0 and a *traceidratio sampler triggers a WARN — no spans will be recorded at ratio 0.

Span names and key attributes¶

When tracing.enabled is true the following spans are emitted:

PII note: Spans are unaggregated (like logs), so useful identifiers such as the tailnet name and device ID appear on url.full by design — they help operators answer "which device's request failed or was slow?" Tier-1 secrets (auth headers/tokens, OAuth/webhook/logstream credentials) and large response/request bodies are never attached. Per-record source/destination IPs are not put on receiver spans; they flow to the flow/audit log records instead.