datadog 2.40.0 → 2.42.0

data/lib/datadog/data_streams/pathway_context.rb

@@ -98,40 +98,38 @@ module Datadog
       end
       private_class_method :decode
 
-      # Encode an unsigned 64-bit integer using LEB128 variable-length encoding.
+      # Encode a signed 64-bit integer using ZigZag + LEB128 variable-length encoding.
       #
-      # This implements unsigned LEB128 (Little Endian Base 128) encoding as specified
-      # in DWARF5 standard section 7.6:
-      # https://dwarfstd.org/doc/DWARF5.pdf#page=301
+      # dd-trace-go's DSM pathway encoder (internal/datastreams/propagator.go, via
+      # sketches-go's ddsketch/encoding package) ZigZag-maps the signed value before
+      # applying plain unsigned LEB128 (DWARF5 section 7.6:
+      # https://dwarfstd.org/doc/DWARF5.pdf#page=301). This implementation previously
+      # skipped the ZigZag step, which silently decoded to the wrong timestamp on any
+      # dd-trace-go consumer -- see https://github.com/DataDog/dd-trace-go/issues/5163.
       #
-      # Each byte uses 7 bits for data and 1 bit to indicate continuation.
-      # The high bit is set if more bytes follow, clear for the final byte.
+      # ZigZag maps signed values to unsigned ones so small-magnitude negative numbers
+      # still encode to few bytes: 0, -1, 1, -2, 2, ... -> 0, 1, 2, 3, 4, ...
       #
-      # @param value [Integer] Unsigned integer value to encode
+      # @param value [Integer] Signed integer value to encode
       # @return [String] Binary string of encoded bytes
       def encode_var_int_64(value)
+        zigzag = (value << 1) ^ (value >> 63)
         bytes = []
-        while value >= 0x80
-          bytes << ((value & 0x7F) | 0x80)
-          value >>= 7
+        while zigzag >= 0x80
+          bytes << ((zigzag & 0x7F) | 0x80)
+          zigzag >>= 7
         end
-        bytes << value
+        bytes << zigzag
         bytes.pack("C*")
       end
 
-      # Decode an unsigned LEB128 variable-length integer from IO stream.
+      # Decode a signed 64-bit integer encoded with ZigZag + LEB128 from an IO stream.
       #
-      # This implements unsigned LEB128 (Little Endian Base 128) decoding as specified
-      # in DWARF5 standard section 7.6:
-      # https://dwarfstd.org/doc/DWARF5.pdf#page=301
-      #
-      # VarInt format: Each byte uses 7 bits for data, 1 bit for continuation
-      # - High bit set = more bytes follow
-      # - High bit clear = final byte
-      # - Data bits accumulated in little-endian order
+      # See #encode_var_int_64 for why the ZigZag un-map is required to match
+      # dd-trace-go's wire format.
       #
       # @param io [StringIO] IO stream to read from
-      # @return [Integer, nil] Decoded unsigned integer, or nil if malformed
+      # @return [Integer, nil] Decoded signed integer, or nil if malformed
       def self.decode_varint(io)
         value = 0
         shift = 0
@@ -143,7 +141,7 @@ module Datadog
           value |= (byte & 0x7F) << shift
 
           # If high bit is clear, we're done
-          return value unless (byte & 0x80).nonzero?
+          return (value >> 1) ^ -(value & 1) unless (byte & 0x80).nonzero?
 
           shift += 7
 

data/lib/datadog/data_streams/processor.rb

@@ -62,10 +62,27 @@ module Datadog
 
         super()
         self.loop_base_interval = interval
+        # Without this, a preload-then-fork deployment model (e.g. Puma cluster mode with
+        # preload_app!, or Sidekiq Enterprise's sidekiqswarm with SIDEKIQ_PRELOAD_APP) leaves
+        # every forked child with a dead flush thread: Ruby threads don't survive fork, and the
+        # default FORK_POLICY_STOP means #perform would otherwise just mark the worker stopped
+        # instead of restarting it. See #restart_flush_thread.
+        self.fork_policy = Core::Workers::Async::Thread::FORK_POLICY_RESTART
 
         perform
       end
 
+      # Restarts the flush thread if a fork has been detected since this processor was created.
+      # Called by Components#after_fork. Safe to call even when no fork occurred: #perform (via
+      # Workers::Async::Thread) only restarts the worker when +forked?+ is true. Deliberately not
+      # named +after_fork+: Workers::Async::Thread already defines a protected +after_fork+
+      # template method that #perform's internal restart path (+restart_after_fork+) calls on
+      # every restart -- overriding it here would recurse.
+      def restart_flush_thread
+        discard_inherited_state_after_fork! if forked?
+        perform
+      end
+
       # Track Kafka produce offset for lag monitoring
       # @param topic [String] The Kafka topic name
       # @param partition [Integer] The partition number
@@ -79,7 +96,7 @@ module Datadog
             topic: topic,
             partition: partition,
             offset: offset,
-            timestamp_ns: (now.to_f * 1e9).to_i
+            timestamp_ns: (now.to_f * 1e9).to_i,
           }
         )
         true
@@ -98,7 +115,7 @@ module Datadog
             topic: topic,
             partition: partition,
             offset: offset,
-            timestamp: now
+            timestamp: now,
           }
         )
         true
@@ -186,7 +203,7 @@ module Datadog
 
         bucket[:latest_produce_offsets][partition_key] = [
           event[:offset],
-          bucket[:latest_produce_offsets][partition_key] || 0
+          bucket[:latest_produce_offsets][partition_key] || 0,
         ].max
       end
 
@@ -196,7 +213,7 @@ module Datadog
           partition: event[:partition],
           offset: event[:offset],
           timestamp: event[:timestamp],
-          timestamp_sec: event[:timestamp].to_f
+          timestamp_sec: event[:timestamp].to_f,
         }
 
         timestamp_ns = (event[:timestamp].to_f * 1e9).to_i
@@ -216,7 +233,7 @@ module Datadog
             expected_offset: previous_offset + 1,
             actual_offset: event[:offset],
             gap_size: event[:offset] - previous_offset - 1,
-            timestamp_sec: event[:timestamp].to_f
+            timestamp_sec: event[:timestamp].to_f,
           }
         end
 
@@ -302,6 +319,20 @@ module Datadog
         PathwayContext.decode_b64(encoded_ctx)
       end
 
+      # A fork copies whatever was buffered in the parent (unflushed events, aggregated
+      # buckets, consumer stats) into the child. If the parent process is still alive and
+      # flushing (e.g. a supervisor process that stays up after forking workers), letting
+      # the child flush that same inherited data as well would double-report it to the
+      # agent. Discard it instead: losing a few seconds of pre-fork stats is preferable to
+      # corrupting pipeline throughput/lag numbers with duplicates.
+      def discard_inherited_state_after_fork!
+        @event_buffer.pop
+        @stats_mutex.synchronize do
+          @buckets.clear
+          @consumer_stats.clear
+        end
+      end
+
       def flush_stats
         stats_buckets = @stats_mutex.synchronize do
           return if @buckets.empty? && @consumer_stats.empty?
@@ -321,7 +352,7 @@ module Datadog
           "TracerVersion" => Datadog::VERSION::STRING,
           "Lang" => "ruby",
           "Stats" => stats_buckets,
-          "Hostname" => hostname
+          "Hostname" => hostname,
         } # : ::Hash[::String, (::String | ::Array[::String])]
 
         payload["ProcessTags"] = Core::Environment::Process.tags if @settings.experimental_propagate_process_tags_enabled
@@ -400,7 +431,7 @@ module Datadog
             full_pathway_latency_sec: full_pathway_latency_sec,
             payload_size: payload_size,
             tags: tags,
-            timestamp_sec: timestamp_sec
+            timestamp_sec: timestamp_sec,
           }
         )
         true
@@ -449,14 +480,14 @@ module Datadog
             topic, partition = key.split(":", 2)
             backlogs << {
               "Tags" => ["type:kafka_produce", "topic:#{topic}", "partition:#{partition}"],
-              "Value" => offset
+              "Value" => offset,
             }
           end
           bucket[:latest_commit_offsets].each do |key, offset|
             group, topic, partition = key.split(":", 3)
             backlogs << {
               "Tags" => ["type:kafka_commit", "consumer_group:#{group}", "topic:#{topic}", "partition:#{partition}"],
-              "Value" => offset
+              "Value" => offset,
             }
           end
 
@@ -464,7 +495,7 @@ module Datadog
             "Start" => bucket_time_ns,
             "Duration" => @bucket_size_ns,
             "Stats" => bucket_stats,
-            "Backlogs" => backlogs + serialize_consumer_backlogs
+            "Backlogs" => backlogs + serialize_consumer_backlogs,
           }
         end
 
@@ -479,9 +510,9 @@ module Datadog
             "Tags" => [
               "type:kafka_commit",
               "topic:#{stat[:topic]}",
-              "partition:#{stat[:partition]}"
+              "partition:#{stat[:partition]}",
             ],
-            "Value" => stat[:offset]
+            "Value" => stat[:offset],
           }
         end
       end
@@ -494,7 +525,7 @@ module Datadog
         {
           pathway_stats: {},
           latest_produce_offsets: {},
-          latest_commit_offsets: {}
+          latest_commit_offsets: {},
         }
       end
 
@@ -503,7 +534,7 @@ module Datadog
           edge_latency: Datadog::Core::DDSketch.new,
           full_pathway_latency: Datadog::Core::DDSketch.new,
           payload_size_sum: 0,
-          payload_size_count: 0
+          payload_size_count: 0,
         }
       end
     end

data/lib/datadog/di/el/compiler.rb

@@ -31,6 +31,29 @@ module Datadog
           [code, regexps]
         end
 
+        # Returns the identifier that +ast+ directly references at its top
+        # level, so the message path can redact direct references the same
+        # way snapshots redact by name.
+        #
+        # @param ast [untyped] top-level expression AST from a probe definition.
+        # @return [String, nil] the variable name for a `ref`/`iref`, the field
+        #   name for a `getmember`, or the string key for an `index`; nil when
+        #   the top-level expression is not a direct reference.
+        def redaction_identifier(ast)
+          return nil unless Hash === ast && ast.length == 1
+
+          entry = ast.first
+          return nil if entry.nil?
+
+          op, target = entry
+          case op
+          when "ref"
+            target if String === target
+          when "getmember", "index"
+            target[1] if Array === target && target.length == 2 && String === target[1]
+          end
+        end
+
         private
 
         # Steep: https://github.com/soutaro/steep/issues/363

data/lib/datadog/di/el/expression.rb

@@ -12,12 +12,17 @@ module Datadog
         # @param regexps [Array<Regexp>] precompiled `matches` regexps (see
         #   Compiler#precompile_regexp), the second element returned by
         #   Compiler#compile.
-        def initialize(dsl_expr, compiled_expr, regexps = [])
+        # @param redaction_identifier [String, nil] the identifier this
+        #   expression directly references at its top level (see
+        #   Compiler#redaction_identifier); nil when it is not a direct
+        #   reference.
+        def initialize(dsl_expr, compiled_expr, regexps: [], redaction_identifier: nil)
           unless String === compiled_expr
             raise ArgumentError, "compiled_expr must be a string"
           end
 
           @dsl_expr = dsl_expr
+          @redaction_identifier = redaction_identifier
 
           cls = Class.new(Evaluator)
           cls.class_exec do
@@ -28,14 +33,12 @@ module Datadog
               end
             RUBY
           end
-          # cls inherits Evaluator#initialize(regexps), but Steep types
-          # Class#new as () -> untyped and cannot see that initializer
-          # through this dynamically created subclass.
-          @evaluator = cls.new(regexps) # steep:ignore UnexpectedPositionalArgument
+          @evaluator = cls.new(regexps)
         end
 
         attr_reader :dsl_expr
         attr_reader :evaluator
+        attr_reader :redaction_identifier
 
         def evaluate(context)
           @evaluator.evaluate(context)

data/lib/datadog/di/instrumenter.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative "../core/rate_limiter"
 require_relative "../core/utils/time"
 require_relative "../ruby_version"
 require_relative "fatal_exceptions"
@@ -69,12 +70,22 @@ module Datadog
     #
     # @api private
     class Instrumenter
+      # Maximum number of capturing-probe snapshots admitted per second across the
+      # whole process.
+      GLOBAL_SNAPSHOT_RATE_LIMIT = 20
+
+      # Maximum number of non-capturing probe emissions admitted per second across
+      # the whole process.
+      GLOBAL_LOG_RATE_LIMIT = 5000
+
       def initialize(settings, serializer, logger, code_tracker: nil, telemetry: nil)
         @settings = settings
         @serializer = serializer
         @logger = logger
         @telemetry = telemetry
         @code_tracker = code_tracker
+        @global_snapshot_rate_limiter = Datadog::Core::TokenBucket.new(GLOBAL_SNAPSHOT_RATE_LIMIT)
+        @global_log_rate_limiter = Datadog::Core::TokenBucket.new(GLOBAL_LOG_RATE_LIMIT)
 
         @lock = Mutex.new
       end
@@ -91,12 +102,31 @@ module Datadog
       # Component#start! assigns the now-current tracker here.
       attr_writer :code_tracker
 
+      # Process-wide snapshot rate limiter.
+      # @return [Datadog::Core::TokenBucket]
+      attr_reader :global_snapshot_rate_limiter
+      # Process-wide log rate limiter.
+      # @return [Datadog::Core::TokenBucket]
+      attr_reader :global_log_rate_limiter
+
       def capture_expression_evaluator
         @capture_expression_evaluator ||= CaptureExpressionEvaluator.new(
           settings: settings, serializer: serializer, logger: logger, telemetry: telemetry,
         )
       end
 
+      # Returns the process-wide rate limiter for the probe.
+      #
+      # @param probe [Probe] the probe whose invocation is being rate limited
+      # @return [Datadog::Core::TokenBucket] the shared limiter for the probe's category
+      def probe_global_rate_limiter(probe)
+        if probe.capturing?
+          global_snapshot_rate_limiter
+        else
+          global_log_rate_limiter
+        end
+      end
+
       # This is a substitute for Thread::Backtrace::Location
       # which does not have a public constructor.
       # Used for the fabricated stack frame for the method itself
@@ -160,6 +190,7 @@ module Datadog
         end
 
         loc = target_method&.source_location
+        # @type var instrumenter: Instrumenter
         instrumenter = self
 
         mod = Module.new do
@@ -193,7 +224,7 @@ module Datadog
           # user probe on Proc#call cannot intercept the trampoline, and no
           # Proc is allocated for the block.
           if RubyVersion.is?(">= 3")
-            define_method(method_name) do |*args, **kwargs, &target_block| # steep:ignore NoMethod
+            define_method(method_name) do |*args, **kwargs, &target_block|
               # steep:ignore FallbackAny below: Steep cannot narrow the
               # **kwargs parameter inside this define_method block, so it
               # falls back to untyped at the super and run_method_probe sites.
@@ -211,7 +242,7 @@ module Datadog
               end
             end
           else
-            define_method(method_name) do |*args, &target_block| # steep:ignore NoMethod
+            define_method(method_name) do |*args, &target_block|
               if DI.in_probe?
                 return super(*args, &target_block)
               end
@@ -230,7 +261,7 @@ module Datadog
                 super(*args, &target_block)
               end
             end
-            ruby2_keywords(method_name) if respond_to?(:ruby2_keywords, true) # steep:ignore NoMethod
+            ruby2_keywords(method_name) if respond_to?(:ruby2_keywords, true)
           end
         end
 
@@ -461,7 +492,7 @@ module Datadog
       # @param args [Array] positional arguments passed to the probed method
       # @param kwargs [Hash{Symbol => Object}] keyword arguments passed to the probed method
       # @param target_block [Proc, nil] block argument passed to the probed method
-      # @param target_self [Object] the receiver of the probed method invocation
+      # @param target_self [any] the receiver of the probed method invocation
       # @param probe [Datadog::DI::Probe] the probe whose callback this invocation runs
       # @param responder [#probe_executed_callback, #probe_condition_evaluation_failed_callback] callback target invoked with the built Context
       # @param loc [Array(String, Integer), nil] source location of the probed method, or nil for virtual/lazily-defined methods
@@ -528,7 +559,12 @@ module Datadog
           end
 
           rate_limiter = probe.rate_limiter
-          if continue and rate_limiter.nil? || rate_limiter.allow?
+          admitted = continue && (rate_limiter.nil? || rate_limiter.allow?)
+          if admitted && !probe_global_rate_limiter(probe).allow?
+            admitted = false
+            logger.trace { "di: #{probe.type} probe #{probe.id}: skipping due to global rate limit" }
+          end
+          if admitted
             # Arguments may be mutated by the method, therefore
             # they need to be serialized prior to method invocation.
             serialized_entry_args = if probe.capture_snapshot?
@@ -793,6 +829,11 @@ module Datadog
         # and check that it is in fact set.
         return if probe.rate_limiter && !probe.rate_limiter.allow?
 
+        unless probe_global_rate_limiter(probe).allow?
+          logger.trace { "di: #{probe.type} probe #{probe.id}: skipping due to global rate limit" }
+          return
+        end
+
         # The context creation is relatively expensive and we don't
         # want to run it if the callback won't be executed due to the
         # rate limit.

data/lib/datadog/di/logger.rb

@@ -20,9 +20,9 @@ module Datadog
 
       def_delegators :target, :debug
 
-      def trace(&block)
+      def trace
         if settings.dynamic_instrumentation.internal.trace_logging
-          debug(&block)
+          debug { yield }
         end
       end
     end

data/lib/datadog/di/probe.rb

@@ -97,7 +97,7 @@ module Datadog
         @evaluate_at = evaluate_at
         @condition = condition
 
-        @rate_limit = rate_limit || ((@capture_snapshot || !@capture_expressions.empty?) ? 1 : 5000)
+        @rate_limit = rate_limit || (capturing? ? 1 : 5000)
         @rate_limiter = Datadog::Core::TokenBucket.new(@rate_limit)
 
         # At most one report per second.
@@ -166,6 +166,14 @@ module Datadog
         !@capture_expressions.empty?
       end
 
+      # Whether this probe captures user data, either as a full snapshot
+      # or via capture expressions.
+      #
+      # @return [Boolean]
+      def capturing?
+        capture_snapshot? || capture_expressions?
+      end
+
       def evaluate_at_entry?
         evaluate_at == :entry
       end

data/lib/datadog/di/probe_builder.rb

@@ -46,7 +46,7 @@ module Datadog
             raise ArgumentError, "Malformed condition specification for probe: #{config}"
           end
           compiled, regexps = EL::Compiler.new.compile(cond_spec["json"])
-          EL::Expression.new(cond_spec["dsl"], compiled, regexps)
+          EL::Expression.new(cond_spec["dsl"], compiled, regexps: regexps)
         end
         capture_expressions = build_capture_expressions(config["captureExpressions"])
         capture_expressions = dedup_capture_expressions(capture_expressions, config["id"], logger)
@@ -101,7 +101,7 @@ module Datadog
             raise ArgumentError, "captureExpressions entry #{name}: missing or malformed expr"
           end
           compiled, regexps = EL::Compiler.new.compile(expr_spec["json"])
-          expr = EL::Expression.new(expr_spec["dsl"], compiled, regexps)
+          expr = EL::Expression.new(expr_spec["dsl"], compiled, regexps: regexps)
           limits = build_capture_limits(entry["capture"])
           CaptureExpression.new(name: name, expr: expr, limits: limits)
         end
@@ -152,8 +152,9 @@ module Datadog
               unless dsl = segment["dsl"]
                 raise ArgumentError, "Missing dsl for json in segment: #{segment}"
               end
-              compiled, regexps = EL::Compiler.new.compile(ast)
-              EL::Expression.new(dsl, compiled, regexps)
+              compiler = EL::Compiler.new
+              compiled, regexps = compiler.compile(ast)
+              EL::Expression.new(dsl, compiled, regexps: regexps, redaction_identifier: compiler.redaction_identifier(ast))
             else
               # TODO report to telemetry?
             end

data/lib/datadog/di/probe_notification_builder.rb

@@ -179,7 +179,7 @@ module Datadog
         if status == "ERROR"
           diagnostics[:exception] = { # steep:ignore
             type: exception ? exception.class.name : "Error",
-            message: exception ? exception.message : message
+            message: exception ? exception.message : message,
           }
         end
 
@@ -379,6 +379,7 @@ module Datadog
             thread_id: nil,
             version: 2,
           },
+          runtime_id: Core::Environment::Identity.id,
           # TODO add tests that the trace/span id is correctly propagated
           "dd.trace_id": active_trace&.id&.to_s,
           "dd.span_id": active_span&.id&.to_s,
@@ -405,7 +406,7 @@ module Datadog
           when String
             segment
           when EL::Expression
-            serializer.serialize_value_for_message(segment.evaluate(context))
+            serializer.serialize_value_for_message(segment.evaluate(context), name: segment.redaction_identifier)
           else
             raise ArgumentError, "Invalid template segment type: #{segment}"
           end

data/lib/datadog/di/remote.rb

@@ -22,7 +22,7 @@ module Datadog
         # when DI is explicitly disabled, or the runtime cannot run DI
         # (JRuby, Ruby 2.5), that block — including this bit — is skipped.
         # The enable signal itself is delivered in APM_TRACING payloads and
-        # routed here by Tracing::Remote.process_config.
+        # routed here by Tracing::Remote.merge_and_apply_configs.
         CAPABILITIES = [
           1 << 38, # APM_TRACING_ENABLE_DYNAMIC_INSTRUMENTATION: Implicit DI enablement
         ].freeze
@@ -37,7 +37,7 @@ module Datadog
 
         # Entry point for the RC-driven DI enable/disable path.
         #
-        # Invoked from {Datadog::Tracing::Remote.process_config} when an
+        # Invoked from {Datadog::Tracing::Remote.merge_and_apply_configs} when an
         # APM_TRACING payload carries `dynamic_instrumentation_enabled`. Runs
         # on the remote-config thread; never raises.
         #
@@ -45,7 +45,7 @@ module Datadog
         #   false to stop it. The `DD_DYNAMIC_INSTRUMENTATION_ENABLED=false`
         #   env var blocks an enable here (see {.explicitly_disabled?}).
         # @param repository [Datadog::Core::Remote::Configuration::Repository, nil]
-        #   the RC repository, passed by {Datadog::Tracing::Remote.process_config}
+        #   the RC repository, passed by {Datadog::Tracing::Remote.apply_lib_config}
         #   so that a stopped->started transition can reconcile against probes that
         #   were delivered in an earlier poll. nil when called outside the RC
         #   dispatch path (e.g. unit tests), in which case no reconcile happens.

data/lib/datadog/di/serializer.rb

@@ -50,6 +50,13 @@ module Datadog
       # return a safe stub rather than tear the process down.
       SERIALIZABLE_FATAL_EXCEPTION_CLASSES = [SystemExit, SignalException].freeze
 
+      # Placeholder emitted by #serialize_value_for_message in place of a value
+      # whose identifier or type matches the redaction configuration. This
+      # mirrors, for the human-readable log-probe message path, the
+      # notCapturedReason: "redactedIdent"/"redactedType" gating that
+      # #serialize_value applies on the snapshot path.
+      REDACTED_VALUE_FOR_MESSAGE = "[redacted]"
+
       # Third-party library integration / custom serializers.
       #
       # Dynamic instrumentation has limited payload sizes, and for efficiency
@@ -375,9 +382,17 @@ module Datadog
       #
       # We also use the Ruby-like syntax for symbols, which don't exist
       # in other languages.
-      def serialize_value_for_message(value, depth = 1)
+      #
+      # +name+, when given, is the identifier the template expression
+      # references at its top level; a redacted identifier yields the
+      # redaction placeholder, mirroring #serialize_value on the snapshot path.
+      def serialize_value_for_message(value, depth: 1, name: nil)
         # This method is more verbose than "normal" Ruby code to avoid
         # array allocations.
+
+        return REDACTED_VALUE_FOR_MESSAGE if redactor.redact_type?(value)
+        return REDACTED_VALUE_FOR_MESSAGE if name && redactor.redact_identifier?(name)
+
         case value
         when NilClass
           "nil"
@@ -398,7 +413,7 @@ module Datadog
             value = value_
           end
           "[" + value.map do |item|
-            serialize_value_for_message(item, depth - 1)
+            serialize_value_for_message(item, depth: depth - 1)
           end.join(", ") + "]"
         when Hash
           return "..." if depth <= 0
@@ -413,7 +428,12 @@ module Datadog
             truncated = true
           end
           serialized = keys.map do |key|
-            "#{serialize_value_for_message(key, depth - 1)} => #{serialize_value_for_message(value[key], depth - 1)}"
+            serialized_value = if (String === key || Symbol === key) && redactor.redact_identifier?(key)
+              REDACTED_VALUE_FOR_MESSAGE
+            else
+              serialize_value_for_message(value[key], depth: depth - 1)
+            end
+            "#{serialize_value_for_message(key, depth: depth - 1)} => #{serialized_value}"
           end
           if truncated
             serialized[serialized.length] = serialized[serialized.length - 1]
@@ -435,7 +455,12 @@ module Datadog
           serialized = vars.map do |var|
             # +var+ here is always the instance variable name which is a
             # symbol, we do not need to run it through our serializer.
-            "#{var}=#{serialize_value_for_message(value.send(:instance_variable_get, var), depth - 1)}"
+            serialized_value = if redactor.redact_identifier?(var)
+              REDACTED_VALUE_FOR_MESSAGE
+            else
+              serialize_value_for_message(value.send(:instance_variable_get, var), depth: depth - 1)
+            end
+            "#{var}=#{serialized_value}"
           end
           if truncated
             serialized << serialized.last

data/lib/datadog/error_tracking/component.rb

@@ -154,7 +154,7 @@ module Datadog
         attributes = {
           "exception.type" => formatted_exception.type,
           "exception.message" => formatted_exception.message,
-          "exception.stacktrace" => formatted_exception.backtrace
+          "exception.stacktrace" => formatted_exception.backtrace,
         }
         Datadog::Tracing::SpanEvent.new("exception", attributes: attributes)
       end

data/lib/datadog/kit/appsec/events/v2.rb

@@ -19,7 +19,7 @@ module Datadog
           TELEMETRY_METRICS_EVENTS_INTO_TYPES = {
             LOGIN_SUCCESS_EVENT => "login_success",
             LOGIN_FAILURE_EVENT => "login_failure",
-            SIGNUP_EVENT => "signup"
+            SIGNUP_EVENT => "signup",
           }.freeze
 
           class << self
@@ -241,7 +241,7 @@ module Datadog
 
               tags = {
                 event_type: TELEMETRY_METRICS_EVENTS_INTO_TYPES[event],
-                sdk_version: TELEMETRY_METRICS_SDK_VERSION
+                sdk_version: TELEMETRY_METRICS_SDK_VERSION,
               }
               telemetry.inc(TELEMETRY_METRICS_NAMESPACE, TELEMETRY_METRICS_SDK_EVENT, 1, tags: tags)
             end