Learn how to instrument Claude Code-based applications with OpenTelemetry and export large language model (LLM) telemetry via OTLP into Cribl Search. Once your data is in Cribl Search, you can explore and investigate it to troubleshoot issues, analyze model behavior, and monitor performance.

You’ll complete the following high-level steps:

1. Prepare Cribl Search to receive OTLP data.
2. Instrument your Claude Code application (terminal or VS Code) with OpenTelemetry.
3. Explore LLM telemetry use cases in Cribl Search.

Telemetry Captured ​

Claude Code telemetry can include metrics, structured log events, and trace spans (when enabled) with attributes such as:

Semantic conventions follow OpenTelemetry GenAI Semantic Conventions where applicable.

Prerequisites ​

You’ll need:

• Cribl.Cloud Enterprise.
• Search Admin permission or higher.
• Claude Code installed and working on your machine (claude on your PATH, or the VS Code workflow you normally use).
• Network reachability from that machine to your Cribl Search OpenTelemetry Source (host, port, TLS, and optional auth as configured).

Get Data Into Cribl Search ​

Complete these steps before you instrument your LLM application:

1. Add a lakehouse engine. This provides storage and compute for data you’re going to ingest into Cribl Search.
2. Add a Cribl Search OpenTelemetry Source to start ingesting the data.
3. Set up your Datatype rules to parse and structure the incoming data.
4. Set up your Dataset rules to route ingested events into individual Search Datasets. This will let you scope your queries and control retention.

Add a Lakehouse Engine ​

A lakehouse engine is the storage-and-compute unit in Cribl Search that holds ingested OTLP (and other Source data) until Dataset retention expires. See Lakehouse Engines in Cribl Search to learn how to set up a new lakehouse engine.

Configure the OpenTelemetry (OTel) Source in Cribl Search ​

To receive OTLP from your LLM application directly in Cribl Search, add an OpenTelemetry Source.

1. On the Cribl.Cloud top bar, select Products > Search. Under Data, select Add Source > OpenTelemetry.

2. In the New Source modal, configure the following under General Settings:

   • ID: Unique Source ID across your Cribl.Cloud Workspace. Use letters, numbers, underscores, and hyphens.
   • Description (optional): Describe the Source (for example, OTLP from LLM-instrumented apps).
   • Address: Hostname that your OpenTelemetry collector or agent connects to. You will use this in exporter configuration.
   • Port: Network port to listen on. Defaults to 4317 for gRPC and 4318 for HTTP (OTLP standard). Change if you use a custom port.
   • OTLP version: Version that matches your upstream sender (default 1.3.1).
   • Protocol: gRPC (default) or HTTP. This must match your OpenTelemetry exporter.

3. Under Authentication, choose None, Basic, Basic (Credentials Secret), Auth Tokens, or Auth Token (Text Secret) as required. See Set up Authentication.

4. Under Encrypt, enable TLS and set the minimum TLS version when senders must connect over TLS. See Set Up Encryption.

5. Select Save to create the Source.

Your Search OpenTelemetry Source must accept the same OTLP protocol (gRPC vs HTTP/protobuf), TLS, and auth headers that Claude Code sends. Prefer gRPC to port 4317 unless you have validated http/protobuf (often port 4318) for your deployment.

Set Datatype Rules ​

Next, configure Datatype rules to parse, filter, and normalize your data into structured fields.

On the Cribl.Cloud top bar, select Products > Search > Data > Datatyping (auto). Here, you can:

• Use Auto-Datatyping to parse your data automatically.
• Check for uncategorized data that didn’t match any Datatype rules.
• Handle the uncategorized data by adding custom Datatype rules.

See also:

• Datatypes in Cribl Search
• v2 Datatypes in Cribl Search
• List of Stock v2 Datatypes
• Add a Custom v2 Datatype

Add a Dataset and Set Dataset Rules ​

Next, create a Dataset and add Dataset rules to route parsed events into it.

Add a Dataset ​

1. On the Cribl.Cloud top bar, select Products > Search > Data > Datasets.
2. Select Add Dataset.
3. Enter a unique ID.
4. Optionally add a Description and Tags.
5. Set the Dataset type to Search Dataset.
6. Set the Retention period.
7. Select the Engine that will store the data.
8. Select Save.

Set Dataset Rules ​

Dataset rules enable you to route ingested events into individual Search Datasets so you can scope your queries and control retention.

See Organize Your Data for details around how to configure your Dataset rules and plan your Search Datasets based on estimated future storage costs.

Instrument Your Application ​

Use the Terminal or VS Code instructions after your Search OpenTelemetry Source, Datatype rules, and Dataset rules are in place.

Claude Code uses built-in OpenTelemetry export (no separate @opentelemetry/* packages in your repository). Set CLAUDE_CODE_ENABLE_TELEMETRY=1 and OTEL_* variables, then start Claude Code from a shell or editor session that inherits them.

Pick Terminal or VS Code. Both paths emit OTLP from Claude Code into the Source you configured earlier.

export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_METRICS_EXPORTER=otlp
export OTEL_LOGS_EXPORTER=otlp
export OTEL_EXPORTER_OTLP_PROTOCOL=grpc
export OTEL_EXPORTER_OTLP_ENDPOINT="http://<cribl-host>:4317"
# If your Search OpenTelemetry Source requires auth:
# export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer <token>"
export OTEL_METRIC_EXPORT_INTERVAL=10000
export OTEL_LOGS_EXPORT_INTERVAL=5000
export OTEL_RESOURCE_ATTRIBUTES="service.name=claude-code"

claude

CLAUDE_CODE_ENABLE_TELEMETRY=1 \
OTEL_METRICS_EXPORTER=otlp \
OTEL_LOGS_EXPORTER=otlp \
OTEL_EXPORTER_OTLP_PROTOCOL=grpc \
OTEL_EXPORTER_OTLP_ENDPOINT="http://<cribl-host>:4317" \
OTEL_METRIC_EXPORT_INTERVAL=10000 \
OTEL_LOGS_EXPORT_INTERVAL=5000 \
OTEL_RESOURCE_ATTRIBUTES="service.name=claude-code-vscode" \
code .

export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer <token>"

Set Environment Variables ​

Set these environment variables before running your instrumented application. Replace <cribl-host> with your Cribl host address, and <token> with your Bearer token if authentication is enabled on the OTel Source.

Use gRPC (port 4317) ​

Set environment variables using gRPC. This is the recommended method:

export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_METRICS_EXPORTER=otlp
export OTEL_LOGS_EXPORTER=otlp
export OTEL_EXPORTER_OTLP_PROTOCOL=grpc
export OTEL_EXPORTER_OTLP_ENDPOINT="http://<cribl-host>:4317"
export OTEL_METRIC_EXPORT_INTERVAL=10000
export OTEL_LOGS_EXPORT_INTERVAL=5000
export OTEL_RESOURCE_ATTRIBUTES="service.name=claude-code"

# Only if you enabled auth on the Search OpenTelemetry Source:
# export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer <token>"

Use HTTP/protobuf (port 4318) ​

If your OTLP exporter or network path requires HTTP/protobuf instead of gRPC, use port 4318 and set the protocol as shown.

export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_METRICS_EXPORTER=otlp
export OTEL_LOGS_EXPORTER=otlp
export OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf
export OTEL_EXPORTER_OTLP_ENDPOINT="http://<cribl-host>:4318"
export OTEL_METRIC_EXPORT_INTERVAL=10000
export OTEL_LOGS_EXPORT_INTERVAL=5000
export OTEL_RESOURCE_ATTRIBUTES="service.name=claude-code"

# Only if you enabled auth on the Search OpenTelemetry Source:
# export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer <token>"

Environment Variable Reference ​

Use this table to set OTLP export options, optional auth headers for the Search Source, and Claude Code’s telemetry toggle.

Verify Data Flow in Cribl Search ​

After completing the instrumentation process, confirm OTLP events flow from your instrumented app into Cribl Search.

1. On the Cribl.Cloud top bar, select Products > Search > Data > Live Data.
2. Select your OpenTelemetry Source and confirm events appear while you trigger traffic from your Claude Code application.
3. For full Live Data behavior and troubleshooting, see Live Data.

Common Search Issues and Fixes ​

LLM Telemetry Use Cases ​

With data flowing into Cribl Search, you can explore and gain visibility into your Claude Code telemetry:

• Explore LLM telemetry: Explore your Search Dataset in Cribl Search and query it with KQL. Filter and slice by service, model, environment, token usage, cost signals, and error or status fields.
• Investigate incidents and performance regressions: During elevated errors or latency, investigate your LLM Search Dataset. Use aggregations such as summarize or timestats to break down failures by model, deployment, feature, tenant, or region. Use join or related patterns with infrastructure, gateway, or security Datasets for end-to-end context.
• Build dashboards for LLM usage and cost: Use Cribl Search Dashboards to track requests over time by model or app, token usage and derived cost, error rates by environment or tenant, and latency percentiles (for example P95/P99) plus token distributions and traffic share.
• Automate checks with scheduled searches and notifications: Turn important queries (for example, when estimated LLM cost or error rate crosses a threshold over a time window) into Scheduled Searches and attach Notifications to email, Slack, SNS, webhooks, and other targets.

See more detailed LLM telemetry use cases in Cribl Search.

Learn how to instrument Claude Code-based applications with OpenTelemetry, export large language model (LLM) telemetry via OTLP, and send it into Cribl Stream. Once data is in Cribl Stream, you can route, mask, and enrich it before it reaches your observability backends.

You’ll complete the following high-level steps:

1. Configure an OpenTelemetry (OTel) Source in Cribl Stream to receive OTLP data.
2. Instrument your Claude Code application (terminal or VS Code) with OpenTelemetry.
3. Explore LLM telemetry use cases for Cribl Stream.

Telemetry Captured ​

Claude Code telemetry can include metrics, structured log events, and trace spans (when enabled) with attributes such as:

Semantic conventions follow OpenTelemetry GenAI Semantic Conventions where applicable.

Prerequisites ​

• A Cribl Stream instance (v4.x+) with an OpenTelemetry (OTEL) Source enabled.
• Claude Code installed on a host that can reach your Cribl Stream OTel Source.
• Network reachability from that machine to your Cribl Stream OTel Source (host, port, TLS, and optional auth as configured).

Configure the OpenTelemetry (OTel) Source in Cribl Stream ​

Before instrumenting your Claude Code application, configure Cribl Stream to receive OTLP data.

Configure an OTel Source ​

You do not need a separate OpenTelemetry Source for each LLM or agent provider. Configure one OTel Source in Cribl Stream and point all instrumented applications at the same endpoint. Per application, only the service name and provider API key typically differ. Use Routes and Pipelines in Cribl Stream to filter and process events by service.name.

To receive OTLP from your LLM application, add or edit an OpenTelemetry Source on your Worker Group as follows.

1. On the top bar, select Products, and then select Cribl Stream. Under Worker Groups, select a Worker Group. Next, you have two options:

   • To configure via QuickConnect, navigate to Routing > QuickConnect. Select Add Source and select the Source you want from the list, choosing either Select Existing or Add New.
   • To configure via the Routes, select Data > Sources. Select the Source you want. Next, select Add Source.

2. In the New Source modal, configure the following under General Settings:

   • Input ID: Unique ID for this Source. For example, OTel042.
   • Description: Optionally, enter a description.
   • OTLP version: The drop-down offers 0.10.0 and 1.3.1 (default).
   • Protocol: Use the drop-down to choose the protocol matching the data you will ingest: gRPC (default), or HTTP.
   • Address: Enter the hostname/IP to listen on. Defaults to 0.0.0.0 (all addresses, IPv4 format).
   • Port: By default, OTel applications send output to port 4317 when using the gRPC protocol, and port 4318 when using HTTP. This setting defaults to 4317 - you must change it if you set Protocol (below) to HTTP, or you want Cribl Stream to collect data from an OTel application that is using a different port.

   Port 4318 is not available on Cribl-managed Worker Groups in Cribl.Cloud.

   • The Extract spans, Extract metrics, and Extract logs settings are specific to the OpenTelemetry Source. By default, these options are toggled off, allowing Cribl Stream to act as a pass-through that generates a single event for each incoming OTel payload. This is useful when you want to forward complete OTel events to downstream systems, such as persistent storage, without breaking them apart. You can enable these settings to extract and process individual records from within OTel events:
     • Extract spans: Generates an individual event for each span in a trace. Traces typically contain multiple spans.
     • Extract metrics: Generates an individual event for each data point in a metric event. OTel metrics often contain multiple data points per event.
     • Extract logs: Available only when OTLP version is set to 1.3.1. Generates an individual event for each log record. Cribl recommends enabling this option to simplify log transformation and manipulation.
   • Tags: Optionally, add tags to help filter and group Sources within Cribl Stream’s UI. Tags are not included in the event data. Separate tag names using a tab or hard return.

3. Optionally, you can adjust the Authentication, TLS, Persistent Queue Settings, Processing, and Advanced settings, or Connected Destinations.

4. Select Save, then Commit & Deploy.

Instrument Your Application ​

Use the Terminal or VS Code instructions after your OTel Source is configured.

Claude Code uses built-in OpenTelemetry export (no separate @opentelemetry/* packages in your repository). Set CLAUDE_CODE_ENABLE_TELEMETRY=1 and OTEL_* variables, then start Claude Code from a shell or editor session that inherits them.

Pick Terminal or VS Code. Both paths emit OTLP from Claude Code into the Source you configured earlier.

export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_METRICS_EXPORTER=otlp
export OTEL_LOGS_EXPORTER=otlp
export OTEL_EXPORTER_OTLP_PROTOCOL=grpc
export OTEL_EXPORTER_OTLP_ENDPOINT="http://<cribl-host>:4317"
# If your Cribl OTel Source requires auth:
# export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer <token>"
export OTEL_METRIC_EXPORT_INTERVAL=10000
export OTEL_LOGS_EXPORT_INTERVAL=5000
export OTEL_RESOURCE_ATTRIBUTES="service.name=claude-code"

claude

CLAUDE_CODE_ENABLE_TELEMETRY=1 \
OTEL_METRICS_EXPORTER=otlp \
OTEL_LOGS_EXPORTER=otlp \
OTEL_EXPORTER_OTLP_PROTOCOL=grpc \
OTEL_EXPORTER_OTLP_ENDPOINT="http://<cribl-host>:4317" \
OTEL_METRIC_EXPORT_INTERVAL=10000 \
OTEL_LOGS_EXPORT_INTERVAL=5000 \
OTEL_RESOURCE_ATTRIBUTES="service.name=claude-code-vscode" \
code .

export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer <token>"

Set Environment Variables ​

Set these environment variables before running your instrumented application. Replace <cribl-host> with your Cribl host address, and <token> with your Bearer token if authentication is enabled on the OTel Source.

Use gRPC (port 4317) ​

Set environment variables using gRPC. This is the recommended method:

export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_METRICS_EXPORTER=otlp
export OTEL_LOGS_EXPORTER=otlp
export OTEL_EXPORTER_OTLP_PROTOCOL=grpc
export OTEL_EXPORTER_OTLP_ENDPOINT="http://<cribl-host>:4317"
export OTEL_METRIC_EXPORT_INTERVAL=10000
export OTEL_LOGS_EXPORT_INTERVAL=5000
export OTEL_RESOURCE_ATTRIBUTES="service.name=claude-code"

# Only if you enabled auth on the Cribl OTEL Source:
# export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer <token>"

Use HTTP/protobuf (port 4318) ​

If your OTLP exporter or network path requires HTTP/protobuf instead of gRPC, use port 4318 and set the protocol as shown.

export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_METRICS_EXPORTER=otlp
export OTEL_LOGS_EXPORTER=otlp
export OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf
export OTEL_EXPORTER_OTLP_ENDPOINT="http://<cribl-host>:4318"
export OTEL_METRIC_EXPORT_INTERVAL=10000
export OTEL_LOGS_EXPORT_INTERVAL=5000
export OTEL_RESOURCE_ATTRIBUTES="service.name=claude-code"

# Only if you enabled auth on the Cribl OTEL Source:
# export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer <token>"

Environment Variable Reference ​

Use this table to set OTLP export options, optional auth headers for the Cribl Source, and Claude Code’s telemetry toggle.

Verify Data Flow in Cribl Stream ​

After completing the instrumentation process, confirm OTLP events flow from your instrumented app into Cribl Stream.

1. In Cribl Stream, go to Monitoring > Sources and select your OTel Source.
2. Open the Live Data tab.
3. Select Start Capture.
4. Trigger a short Claude Code session (terminal or VS Code as above).
5. Confirm that events appear in Live Data for your OTel Source.

Route Data to Cribl Search ​

After Claude Code OTLP data reaches Cribl Stream, add a Cribl Search Destination so you can explore and investigate LLM telemetry to troubleshoot issues, analyze model behavior, and monitor performance. See the Cribl Search Destination guide for setup instructions.

Common Issues and Fixes ​

If telemetry is missing or the exporter cannot reach Cribl Stream, use this table to narrow down endpoint, authentication, TLS, environment variables, and how Claude Code was started.

LLM Telemetry Use Cases ​

With data flowing into Cribl Stream, you can route Claude Code telemetry to any supported Destination. For example:

• Cribl Search: Search and analyze full-fidelity LLM traces and logs interactively.
• Cribl Lake: Store and search traces natively with partitioning optimized for Cribl Search, so you can query Claude Code traces at scale without re-ingesting them into a separate system.
• Amazon S3 or other object storage: Archive traces for compliance or long-term analysis using partitioning schemes aligned with Cribl Search, so you can query data in place without moving it.
• OpenTelemetry: Forward LLM traces in standard OTLP format to downstream systems.

To set up routing:

1. Add Routes in Routing > Data Routes to match OTel data and direct it to your chosen Destinations.
2. Go to Processing > Pipelines and create a Pipeline to process data flowing down your Route.
3. Use Functions to enrich, filter, sample, or redact data before delivery. For example:
   • Mask prompt/completion content containing sensitive information.
   • Sample high-volume traces to reduce cost.
   • Aggregate token usage metrics by model or service.

For more detailed LLM telemetry use cases, see LLM Telemetry Use Cases in Cribl.