# PII Masking & Query Hash Anonymization > Depth-first rabbithole dossier for PII Masking & Query Hash Anonymization; source-anchored research pack. Parent: [Diagnostic Tool Design](https://llms-explorer.com/tree/diagnostic-tool-design/) · 6 facets · 29 facts · page: https://llms-explorer.com/tree/pii-masking-query-hash-anonymization/ ## Definitions - [low] The `internalQueryStatsSampleRate` parameter is a floating-point number between 0.0 and 1.0 representing the fraction of queries for which stats are recorded. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` - [low] Query stats are not collected on explain-only paths, but aggregate explains run through the same path as non-explains and thus have query stats collected. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` ## Structure and components - [low] Instrumentations should not capture `db.query.parameter.` by default since values may contain PII, but parameterized query text itself should be collected by default. Sources: https://opentelemetry.io/docs/specs/semconv/database/database-spans/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` - [low] The `db.query.summary` attribute should have low cardinality, contain no dynamic or sensitive data, and be truncated to 255 characters if parsed from the query. Sources: https://opentelemetry.io/docs/specs/semconv/database/database-spans/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` ## How it works - [low] Metrics recorded only when plan enumeration runs are reported alongside the `numPlanEnumerations` counter, which serves as the denominator. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` - [low] Collection and operation names should not be extracted from `db.query.text` when the database system supports multiple collections or operations in non-batch operations. Sources: https://opentelemetry.io/docs/specs/semconv/database/database-spans/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` ## Measurements and reference values - [low] The maximum query stats store size defaults to 1% of the machine's total memory and can be specified as a string like "4MB" or "1%". Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` ## Problems, failure modes and limitations - [low] The `internalQueryStatsRateLimit` parameter is an integer imposing a maximum number of recordings per second, defaulting to 0 (disabled) or -1 for no limit. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` - [low] The query stats store is a partitioned LRU cache structure where least recently used entries are evicted if a partition exceeds its size limit. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` - [low] Query stats collection for write commands is controlled by a parameter set to 0 or 1, which is only effective if query stats are already enabled via rate limit or sample rate settings. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` ## Facts and statements - [high] The only currently supported `algorithm` value for PII masking in query stats is `hmac-sha-256`. Sources: https://www.mongodb.com/docs/manual/reference/operator/aggregation/queryStats.md, https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` - [low] A one-way tokenized object applies an HMAC hashing function to sensitive elements, ensuring the transformation is never meant to be undone. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` - [low] MongoDB retains anonymized query data collected via `$queryStats` for four years to help improve MongoDB products. Sources: https://www.mongodb.com/docs/manual/reference/operator/aggregation/queryStats.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` - [low] If both `internalQueryStatsSampleRate` and `internalQueryStatsRateLimit` are set to non-zero values, the sampling-based policy takes precedence over the window-based rate limiter. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` - [low] For change stream collections, each `getMore` operation is treated as its own query, with query stats collected and updated for each one. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` - [low] Update and delete operations register and record metrics per statement, while insert operations register and record metrics per command. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` - [low] In sharded deployments, the router aggregates metrics received from shards into its own query stats store. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` - [low] Metrics for join optimization are always collected locally on sharded collections and are never rolled up from shards. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` - [high] The `cpuNanos` field, which specifies total CPU time in nanoseconds, is only available on Linux systems and will not be returned on other platforms. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/log-messages.md, https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` - [low] The `http.url` tag includes the full URL with query string, and Datadog parses and redacts suspicious-looking values in the query string by default. Sources: https://docs.datadoghq.com/tracing/configure_data_security/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` - [low] Semantic conventions state that `db.query.text` should be collected by default only if sanitization excludes sensitive information, replacing literals with a placeholder value like "?". Sources: https://opentelemetry.io/docs/specs/semconv/database/database-spans/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` - [low] Parameterized query text should not be sanitized, while non-parameterized query text should not be collected by default unless sanitization excludes sensitive data. Sources: https://opentelemetry.io/docs/specs/semconv/database/database-spans/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` - [low] Instrumentations should capture operation and target values without case normalization, and these values should match those used in `db.query.summary`. Sources: https://opentelemetry.io/docs/specs/semconv/database/database-spans/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` - [low] For batch operations, query text and summary should be handled based on whether individual operations share the same text or summary, using separators or prefixes like "BATCH". Sources: https://opentelemetry.io/docs/specs/semconv/database/database-spans/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` - [low] Hashing transforms data like email addresses or phone numbers into consistent hexadecimal numbers, but hashes are not anonymous and can still be used to identify users. Sources: https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/07/no-hashing-still-doesnt-make-your-data-anonymous — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#core` - [low] The `DD_APM_OBFUSCATION_HTTP_REMOVE_QUERY_STRING` environment variable obfuscates query strings in URLs if true, and `DD_APM_OBFUSCATION_HTTP_REMOVE_PATHS_WITH_DIGITS` replaces path segments containing digits with "?". Sources: https://docs.datadoghq.com/tracing/configure_data_security/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#tools` - [low] The regular expression for query string redaction can be modified via the `DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP` environment variable, and query string collection can be disabled by setting `DD_HTTP_SERVER_TAG_QUERY_STRING` to false. Sources: https://docs.datadoghq.com/tracing/configure_data_security/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#tools` - [low] Metrics collection for query stats occurs in the hot path of query execution and must add negligible CPU and memory cost. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#methodology` - [low] Aggregation semantics for query stats metrics use addition for totals, maximum for maximums, OR for boolean flags, and AND for conjunctions. Sources: https://raw.githubusercontent.com/mongodb/mongo/master/src/mongo/db/query/query_stats/README.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/pii-masking-query-hash-anonymization-073aca5e72/rabbithole-synthesis.md#patterns` ## Related concepts - Query — is a part of PII Masking & Query Hash Anonymization - PII — is a part of PII Masking & Query Hash Anonymization - Masking — is a part of PII Masking & Query Hash Anonymization - Hash — is a part of PII Masking & Query Hash Anonymization