One pipeline, three signals.

The collector runs inside your network. Redaction, sampling and batching all happen before anything crosses the boundary, which means a sensitive field is never transmitted and then scrubbed — it is never transmitted.

• Standard OpenTelemetry Collector with one Northwind exporter
• Redaction rules are ordinary processor config, reviewable in your repo
• Buffers to disk if we are unreachable, so a Northwind outage is not yours
• No proprietary agent, no kernel module, no sidecar requirement

# The whole integration. Eleven lines.
processors:
  redact:
    # Never leaves the VPC unredacted
    blocked_key_patterns: ["patient_.*", ".*_ssn"]

exporters:
  northwind:
    endpoint: "ingest.northwind.example"
    api_key: "${NORTHWIND_API_KEY}"
    compression: zstd

# p95 latency by endpoint, last hour
metric("http.server.duration")
  | where service == "checkout-api"
  | percentile(95) by endpoint
  | over(1h)

# The traces behind the worst endpoint
trace()
  | where service == "checkout-api"
    and endpoint == "/v1/charge"
    and duration > 800ms

# And the logs those traces emitted
log() | where trace_id in above()

During an incident nobody has the working memory to hold three query syntaxes at once. NWQL is one language across all three signals, and above() chains a result into the next query.

• PromQL runs unmodified, so existing dashboards and rules keep working
• Joins across signals on shared resource attributes
• Query results are addressable, so a chain is one expression rather than four tabs

Read the NWQL reference