otel collector contrib: New OTTL UTF8 Converter, Cosign Verification, and Prometheus Fixes

I looked at the last week of commits in opentelemetry-collector-contrib, the collection of receivers, processors, and exporters around the OpenTelemetry Collector. 148 commits landed. The headline items are a new experimental ToValidUTF8 OTTL converter, a Cosign package verifier for the OpAMP supervisor, and a batch of performance work in the prometheus receiver.

A new OTTL converter that cleans invalid UTF8

The most recent change adds an experimental ToValidUTF8 converter to the extended OTTL function set. The merge lives in Add experimental ToValidUTF8 converter (#51722), with the commit in the converter landing.

The problem it solves is common: log lines or attributes that contain invalid UTF8 byte sequences. Those bytes can break downstream systems that expect valid text. The converter replaces each run of invalid bytes with a replacement string. The default is the Unicode replacement character. An optional second argument sets a custom replacement, and an empty replacement strips the bytes.

set(body, ToValidUTF8(body))
set(attributes["msg"], ToValidUTF8(attributes["msg"], "?"))

Two caveats worth knowing:

• The function is experimental. It requires the pkg.ottl.functions.enableExperimental feature gate.
• It lives in pkg/ottl/xottl, the extended set, not the core converter list.

Related OTTL work: dynamic map keys now work (#52211), and map insert paths got faster (#52306) by using a GetOrPutEmpty style insert and skipping no-op key replacement.

The OpAMP supervisor can verify packages with Cosign

The cmd/opampsupervisor gained a Cosign package verifier this week. See Add Cosign package verifier (#50707). The supervisor downloads collector packages on behalf of the server, so this closes a real gap: agents can now check signatures before installing an update. If you run collector fleets managed through OpAMP, this is worth turning on once it is exposed in your manager of choice.

Prometheus receiver and remote write fixes

The prometheus side saw both speed and correctness work.

One commit optimizes metadata lookups, exemplar hex decoding, and slice preallocation in the receiver. No numbers are published, but preallocation and lookup caching tend to matter at high scrape cardinality. A small followup fixes a stale comment on isDiscernibleHost.

On the remote write side, dropped classic histogram and summary series are now counted as written (#52252). This makes the exporter metrics reflect what actually happened, so dashboards built on accepted series no longer undercount.

New metrics from receivers

Two receivers shipped new telemetry:

• The googlecloudspanner receiver gains active_partitioned_dmls (#52254)
• The same receiver gains oldest_active_queries with a truncate_text config for long query texts
• The flinkmetrics receiver gets an opt-in flink.job.id resource attribute (#51638), which makes it possible to group Flink metrics per job after enrichment

The Spanner additions are aimed at spotting stuck partitioned DML and long running queries. Both are easy to wire into existing dashboards once you upgrade the receiver.

Dependency bumps and a security note

The usual renovate wave touched many go.mod files. Two stand out:

• go-jose was bumped to v4.1.6 as a security update, and the signing processor got the same bump in a separate patch
• The brotli dependency was updated, affecting the clickhouse exporter, sqlquery receiver, AWS internals, and the awslogs encoding extension

The top changed files are mostly go.mod and go.sum across modules like testbed and the datadog e2e module, plus the opamp supervisor which pulled in Cosign.

What to watch

• The ToValidUTF8 converter is gated behind pkg.ottl.functions.enableExperimental. Expect the gate to change or the function to graduate within a few releases.
• Keep an eye on OpAMP supervisor config: package verification is a security relevant feature that operators should adopt early.
• If you run the prometheus receiver at scale, the metadata lookup optimizations are a reason to test the next patch release on a staging collector first.