docs: add more transform examples (#2684)

Author: a-thaler

docs/user/filter-and-process/ottl-transform-and-filter/README.md

@@ -30,6 +30,7 @@ This sequence means that your OTTL rules only operate on data that has already p
 ## Limitations
 
 ### Always Use the Full Context Path
+
 You must specify the full path for every field. Short-hand references are not supported.
 
 - Correct: `resource.attributes["k8s.namespace.name"] == "default"`, `log.attributes["level"]`, `datapoint.value_int`, `span.name`

docs/user/filter-and-process/ottl-transform-and-filter/ottl-filter.md

@@ -63,4 +63,4 @@ spec:
   filter:
     - conditions:
         - 'IsMatch(metric.name, "^envoy_") == true and IsMatch(metric.name, ".*outlier_detection.*") == false'
-```
+```

docs/user/filter-and-process/ottl-transform-and-filter/ottl-transform.md

@@ -7,6 +7,7 @@ Use transformations to modify telemetry data as it flows through a pipeline. You
 You define these rules in the `transform` section of your Telemetry pipeline's `spec`.
 
 Each rule in the `transform` list contains:
+
 - `statements`: One or more OTTL functions that modify the data. These are the actions that you want to perform.
 - `conditions` (optional): One or more OTTL conditions that must be met. If you provide conditions, the statements only run on data that matches at least one of the conditions.
 
@@ -51,4 +52,59 @@ spec:
         - 'IsMatch(resource.attributes["k8s.namespace.name"], ".*-system")'
       statements:
         - 'set(span.attributes["system"], "true")'
-```
+```
+
+## Example: Parse Custom Log Formats
+
+If your application writes logs to stdout in a custom format, you can use a series of OTTL statements to parse these logs into structured data, so you can easily query and analyze them in your observability backend. The following example parses the payload and enriches core attributes:
+
+```yaml
+# In your LogPipeline spec
+spec:
+  input:
+    application:
+      enabled: true
+  output:
+    otlp:
+      endpoint:
+        value: http://traces.example.com:4317
+  transform:
+    # Try to parse the body as custom parser (default spring boot logback)
+    # 2025-11-12T14:40:36.828Z  INFO 1 --- [demo] [           main] c.e.restservice.RestServiceApplication   : Started Application
+    - statements:
+        - merge_maps(log.attributes, ExtractPatterns(log.body,"^(?P<timestamp>\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d+Z)\\s+(?P<level>[A-Z]+)\\s+(?P<pid>\\d+)\\s+---\\s+\\[(?P<mdc>[^\\]]+)\\]\\s+\\[\\s*(?P<thread>[^\\]]+)\\s*\\]\\s+(?P<logger>[^\\s:]+)\\s*:\\s*(?P<msg>.*)$"), "upsert")
+
+    # Try to enrich core attributes if custom parsing was successful
+    - conditions:
+        - log.attributes["msg"] != nil
+      statements:
+        - set(log.body, log.attributes["msg"])
+        - delete_key(log.attributes, "msg")
+    - conditions:
+        - log.attributes["timestamp"] != nil
+      statements:
+        - set(log.time, Time(log.attributes["timestamp"], "2006-01-02T15:04:05.000Z"))
+        - delete_key(log.attributes, "timestamp")
+    - conditions:
+        - log.attributes["level"] != nil
+      statements:
+        - set(log.severity_text, ToUpperCase(log.attributes["level"]))
+        - delete_key(log.attributes, "level")
+```
+
+## Example: Redact Sensitive Data in Spans
+
+To improve security and meet compliance requirements, you can redact sensitive information from your telemetry data before it leaves the cluster. 
+
+```yaml
+# In your TracePipeline spec
+spec:
+  output:
+    otlp:
+      endpoint:
+        value: http://traces.example.com:4317
+  transform:
+      - statements:
+          - replace_pattern(span.attributes["http.url"], "client_id=[^&]+", "client_id=[REDACTED]")
+          - replace_pattern(span.attributes["http.url"], "client_secret=[^&]+", "client_secret=[REDACTED]")
+```