Learn how to instrument Grok-based applications with OpenTelemetry and export large language model (LLM) telemetry via OTLP into Cribl Search. Once your data is in Cribl Search, you can explore and investigate it to troubleshoot issues, analyze model behavior, and monitor performance.

You’ll complete the following high-level steps:

1. Configure an OpenTelemetry (OTel) Source in Cribl Search to receive OTLP data.
2. Instrument your Grok application (Node.js or Python) with OpenTelemetry.
3. Explore LLM telemetry use cases in Cribl Search.

Telemetry Captured ​

Each Grok API call produces a trace span with these attributes:

Semantic conventions follow OpenTelemetry GenAI Semantic Conventions where applicable.

Grok exposes an OpenAI-compatible API. Instrumentation uses the standard OpenAI SDK and OpenAI OTel packages pointed at xAI’s base URL. No Grok-specific instrumentation library is required.

Prerequisites ​

You’ll need:

• Cribl.Cloud Enterprise.
• Search Admin permission or higher.
• An xAI API key with access to the models you want to monitor.
• Node.js 18+ or Python 3.9+ depending on your application language.

Get Data Into Cribl Search ​

Complete these steps before you instrument your LLM application:

1. Add a lakehouse engine. This provides storage and compute for data you’re going to ingest into Cribl Search.
2. Add a Cribl Search OpenTelemetry Source to start ingesting the data.
3. Set up your Datatype rules to parse and structure the incoming data.
4. Set up your Dataset rules to route ingested events into individual Search Datasets. This will let you scope your queries and control retention.

Add a Lakehouse Engine ​

A lakehouse engine is the storage-and-compute unit in Cribl Search that holds ingested OTLP (and other Source data) until Dataset retention expires. See Lakehouse Engines in Cribl Search to learn how to set up a new lakehouse engine.

Configure the OpenTelemetry (OTel) Source in Cribl Search ​

To receive OTLP from your LLM application directly in Cribl Search, add an OpenTelemetry Source.

1. On the Cribl.Cloud top bar, select Products > Search. Under Data, select Add Source > OpenTelemetry.

2. In the New Source modal, configure the following under General Settings:

   • ID: Unique Source ID across your Cribl.Cloud Workspace. Use letters, numbers, underscores, and hyphens.
   • Description (optional): Describe the Source (for example, OTLP from LLM-instrumented apps).
   • Address: Hostname that your OpenTelemetry collector or agent connects to. You will use this in exporter configuration.
   • Port: Network port to listen on. Defaults to 4317 for gRPC and 4318 for HTTP (OTLP standard). Change if you use a custom port.
   • OTLP version: Version that matches your upstream sender (default 1.3.1).
   • Protocol: gRPC (default) or HTTP. This must match your OpenTelemetry exporter.

3. Under Authentication, choose None, Basic, Basic (Credentials Secret), Auth Tokens, or Auth Token (Text Secret) as required. See Set up Authentication.

4. Under Encrypt, enable TLS and set the minimum TLS version when senders must connect over TLS. See Set Up Encryption.

5. Select Save to create the Source.

Set Datatype Rules ​

Next, configure Datatype rules to parse, filter, and normalize your data into structured fields.

On the Cribl.Cloud top bar, select Products > Search > Data > Datatyping (auto). Here, you can:

• Use Auto-Datatyping to parse your data automatically.
• Check for uncategorized data that didn’t match any Datatype rules.
• Handle the uncategorized data by adding custom Datatype rules.

See also:

• Datatypes in Cribl Search
• v2 Datatypes in Cribl Search
• List of Stock v2 Datatypes
• Add a Custom v2 Datatype

Add a Dataset and Set Dataset Rules ​

Next, create a Dataset and add Dataset rules to route parsed events into it.

Add a Dataset ​

1. On the Cribl.Cloud top bar, select Products > Search > Data > Datasets.
2. Select Add Dataset.
3. Enter a unique ID.
4. Optionally add a Description and Tags.
5. Set the Dataset type to Search Dataset.
6. Set the Retention period.
7. Select the Engine that will store the data.
8. Select Save.

Set Dataset Rules ​

Dataset rules enable you to route ingested events into individual Search Datasets so you can scope your queries and control retention.

See Organize Your Data for details around how to configure your Dataset rules and plan your Search Datasets based on estimated future storage costs.

Instrument Your Application ​

Select Node.js or Python from the tabs. Both paths use the OpenAI SDK pointed at xAI’s base URL, and the same OpenAI OTel instrumentation packages that work for OpenAI applications.

npm install @opentelemetry/sdk-node \
  @opentelemetry/api \
  @opentelemetry/exporter-trace-otlp-grpc \
  @opentelemetry/instrumentation-openai \
  openai

// tracing.js: load this BEFORE your app code
const { NodeSDK } = require('@opentelemetry/sdk-node');
const { OTLPTraceExporter } = require('@opentelemetry/exporter-trace-otlp-grpc');
const { OpenAIInstrumentation } = require('@opentelemetry/instrumentation-openai');

const sdk = new NodeSDK({
  traceExporter: new OTLPTraceExporter(),
  instrumentations: [new OpenAIInstrumentation()],
});
sdk.start();

// app.js: import tracing first, then use OpenAI SDK with Grok
const OpenAI = require('openai');

const client = new OpenAI({
  baseURL: 'https://api.x.ai/v1',
  apiKey: process.env.XAI_API_KEY,
});

async function main() {
  const response = await client.chat.completions.create({
    model: 'grok-3',
    messages: [{ role: 'user', content: 'Hello!' }],
  });
  console.log(response.choices[0].message.content);
}

main();

node -r ./tracing.js app.js

npm install @opentelemetry/auto-instrumentations-node \
  @opentelemetry/sdk-node \
  @opentelemetry/exporter-trace-otlp-grpc \
  openai

node --require @opentelemetry/auto-instrumentations-node/register app.js

pip install opentelemetry-distro opentelemetry-instrumentation-openai-v2 opentelemetry-exporter-otlp

opentelemetry-bootstrap -a install

opentelemetry-instrument python app.py

# tracing.py: import this BEFORE your app code
from opentelemetry import trace
from opentelemetry.sdk.trace import TracerProvider
from opentelemetry.sdk.trace.export import BatchSpanProcessor
from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import OTLPSpanExporter
from opentelemetry.instrumentation.openai_v2 import OpenAIInstrumentor

provider = TracerProvider()
provider.add_span_processor(BatchSpanProcessor(OTLPSpanExporter()))
trace.set_tracer_provider(provider)

OpenAIInstrumentor().instrument()

import tracing  # must be first - instruments the openai module
import os
from openai import OpenAI

client = OpenAI(
    api_key=os.environ["XAI_API_KEY"],
    base_url="https://api.x.ai/v1",
)

response = client.chat.completions.create(
    model="grok-3",
    messages=[{"role": "user", "content": "Hello!"}],
)
print(response.choices[0].message.content)

Set Environment Variables ​

Set these environment variables before running your instrumented application. Replace <cribl-host> with your Cribl host address, and <token> with your Bearer token if authentication is enabled on the OTel Source.

Use gRPC (port 4317) ​

Set environment variables using gRPC. This is the recommended method:

export OTEL_EXPORTER_OTLP_ENDPOINT="http://<cribl-host>:4317"
export OTEL_EXPORTER_OTLP_PROTOCOL="grpc"
export OTEL_SERVICE_NAME="my-grok-app"

# Only if you enabled auth on the Cribl OTEL Source:
export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer <token>"

Use HTTP/protobuf (port 4318) ​

If your OTLP exporter or network path requires HTTP/protobuf instead of gRPC, use port 4318 and set the protocol as shown. If TLS is enabled on your Cribl OTel Source, use https:// instead of http://.

export OTEL_EXPORTER_OTLP_ENDPOINT="http://<cribl-host>:4318"
export OTEL_EXPORTER_OTLP_PROTOCOL="http/protobuf"
export OTEL_SERVICE_NAME="my-grok-app"

# Only if you enabled auth on the Cribl OTEL Source:
export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer <token>"

Environment Variable Reference ​

Use this table to set OTLP export options, optional auth headers for the Cribl Source, and the xAI API key.

Capture Prompt/Completion Content ​

Enabling content capture may expose sensitive data in your telemetry pipeline.

By default, prompt and completion content is not captured to protect sensitive data. To enable it:

export OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT="true"

Verify Data Flow in Cribl Search ​

After completing the instrumentation process, confirm OTLP events flow from your instrumented app into Cribl Search.

1. On the Cribl.Cloud top bar, select Products > Search > Data > Live Data.
2. Select your OpenTelemetry Source and confirm that events appear while you trigger traffic from your Grok application.
3. For full Live Data behavior and troubleshooting, check Live Data.

Common Search Issues and Fixes ​

LLM Telemetry Use Cases ​

With data flowing into Cribl Search, you can explore and gain visibility towards your Grok telemetry:

• Explore LLM telemetry: Explore your Search Dataset in Cribl Search and query it with KQL. Filter and slice by service, model, environment, token usage, cost signals, and error or status fields.
• Investigate incidents and performance regressions: During elevated errors or latency, investigate your LLM Search Dataset. Use aggregations such as summarize or timestats to break down failures by model, deployment, feature, tenant, or region. Use join or related patterns with infrastructure, gateway, or security Datasets for end-to-end context.
• Build dashboards for LLM usage and cost: Use Cribl Search Dashboards to track requests over time by model or app, token usage and derived cost, error rates by environment or tenant, and latency percentiles (for example P95/P99) plus token distributions and traffic share.
• Automate checks with scheduled searches and notifications: Turn important queries (for example, when estimated LLM cost or error rate crosses a threshold over a time window) into Scheduled Searches and attach Notifications to email, Slack, SNS, webhooks, and other targets.

See more detailed LLM telemetry use cases in Cribl Search.

Learn how to instrument Grok-based applications with OpenTelemetry, export large language model (LLM) telemetry via OTLP, and send it into Cribl Stream. Once data is in Cribl Stream, you can route, mask, and enrich it before it reaches your observability backends.

You’ll complete the following high-level steps:

1. Configure an OpenTelemetry (OTel) Source in Cribl Stream to receive OTLP data.
2. Instrument your Grok application (Node.js or Python) with OpenTelemetry.
3. Explore LLM telemetry use cases for Cribl Stream.

Telemetry Captured ​

Each Grok API call produces a trace span with these attributes:

Semantic conventions follow OpenTelemetry GenAI Semantic Conventions where applicable.

Grok exposes an OpenAI-compatible API. Instrumentation uses the standard OpenAI SDK and OpenAI OTel packages pointed at xAI’s base URL. No Grok-specific instrumentation library is required.

Prerequisites ​

• A Cribl Stream instance (v4.x+) with an OpenTelemetry (OTEL) Source enabled.
• An xAI API key with access to the models you want to monitor.
• Node.js 18+ or Python 3.9+ depending on your application language.

Configure the OpenTelemetry (OTel) Source in Cribl Stream ​

Before instrumenting your Grok app, configure Cribl Stream to receive OTLP data.

Configure an OTel Source ​

You do not need a separate OpenTelemetry Source for each LLM or agent provider. Configure one OTel Source in Cribl Stream and point all instrumented applications at the same endpoint. Per application, only the service name and provider API key typically differ. Use Routes and Pipelines in Cribl Stream to filter and process events by service.name.

To receive OTLP from your LLM application, add or edit an OpenTelemetry Source on your Worker Group as follows.

1. On the top bar, select Products, and then select Cribl Stream. Under Worker Groups, select a Worker Group. Next, you have two options:

   • To configure via QuickConnect, navigate to Routing > QuickConnect. Select Add Source and select the Source you want from the list, choosing either Select Existing or Add New.
   • To configure via the Routes, select Data > Sources. Select the Source you want. Next, select Add Source.

2. In the New Source modal, configure the following under General Settings:

   • Input ID: Unique ID for this Source. For example, OTel042.
   • Description: Optionally, enter a description.
   • OTLP version: The drop-down offers 0.10.0 and 1.3.1 (default).
   • Protocol: Use the drop-down to choose the protocol matching the data you will ingest: gRPC (default), or HTTP.
   • Address: Enter the hostname/IP to listen on. Defaults to 0.0.0.0 (all addresses, IPv4 format).
   • Port: By default, OTel applications send output to port 4317 when using the gRPC protocol, and port 4318 when using HTTP. This setting defaults to 4317 - you must change it if you set Protocol (below) to HTTP, or you want Cribl Stream to collect data from an OTel application that is using a different port.

   Port 4318 is not available on Cribl-managed Worker Groups in Cribl.Cloud.

   • The Extract spans, Extract metrics, and Extract logs settings are specific to the OpenTelemetry Source. By default, these options are toggled off, allowing Cribl Stream to act as a pass-through that generates a single event for each incoming OTel payload. This is useful when you want to forward complete OTel events to downstream systems, such as persistent storage, without breaking them apart. You can enable these settings to extract and process individual records from within OTel events:
     • Extract spans: Generates an individual event for each span in a trace. Traces typically contain multiple spans.
     • Extract metrics: Generates an individual event for each data point in a metric event. OTel metrics often contain multiple data points per event.
     • Extract logs: Available only when OTLP version is set to 1.3.1. Generates an individual event for each log record. Cribl recommends enabling this option to simplify log transformation and manipulation.
   • Tags: Optionally, add tags to help filter and group Sources within Cribl Stream’s UI. Tags are not included in the event data. Separate tag names using a tab or hard return.

3. Optionally, you can adjust the Authentication, TLS, Persistent Queue Settings, Processing, and Advanced settings, or Connected Destinations.

4. Select Save, then Commit & Deploy.

Instrument Your Application ​

Select Node.js or Python from the tabs. Both paths use the OpenAI SDK pointed at xAI’s base URL, and the same OpenAI OTel instrumentation packages that work for OpenAI applications.

npm install @opentelemetry/sdk-node \
  @opentelemetry/api \
  @opentelemetry/exporter-trace-otlp-grpc \
  @opentelemetry/instrumentation-openai \
  openai

// tracing.js: load this BEFORE your app code
const { NodeSDK } = require('@opentelemetry/sdk-node');
const { OTLPTraceExporter } = require('@opentelemetry/exporter-trace-otlp-grpc');
const { OpenAIInstrumentation } = require('@opentelemetry/instrumentation-openai');

const sdk = new NodeSDK({
  traceExporter: new OTLPTraceExporter(),
  instrumentations: [new OpenAIInstrumentation()],
});
sdk.start();

// app.js: import tracing first, then use OpenAI SDK with Grok
const OpenAI = require('openai');

const client = new OpenAI({
  baseURL: 'https://api.x.ai/v1',
  apiKey: process.env.XAI_API_KEY,
});

async function main() {
  const response = await client.chat.completions.create({
    model: 'grok-3',
    messages: [{ role: 'user', content: 'Hello!' }],
  });
  console.log(response.choices[0].message.content);
}

main();

node -r ./tracing.js app.js

npm install @opentelemetry/auto-instrumentations-node \
  @opentelemetry/sdk-node \
  @opentelemetry/exporter-trace-otlp-grpc \
  openai

node --require @opentelemetry/auto-instrumentations-node/register app.js

pip install opentelemetry-distro opentelemetry-instrumentation-openai-v2 opentelemetry-exporter-otlp

opentelemetry-bootstrap -a install

opentelemetry-instrument python app.py

# tracing.py: import this BEFORE your app code
from opentelemetry import trace
from opentelemetry.sdk.trace import TracerProvider
from opentelemetry.sdk.trace.export import BatchSpanProcessor
from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import OTLPSpanExporter
from opentelemetry.instrumentation.openai_v2 import OpenAIInstrumentor

provider = TracerProvider()
provider.add_span_processor(BatchSpanProcessor(OTLPSpanExporter()))
trace.set_tracer_provider(provider)

OpenAIInstrumentor().instrument()

import tracing  # must be first - instruments the openai module
import os
from openai import OpenAI

client = OpenAI(
    api_key=os.environ["XAI_API_KEY"],
    base_url="https://api.x.ai/v1",
)

response = client.chat.completions.create(
    model="grok-3",
    messages=[{"role": "user", "content": "Hello!"}],
)
print(response.choices[0].message.content)

Set Environment Variables ​

Set these environment variables before running your instrumented application. Replace <cribl-host> with your Cribl host address, and <token> with your Bearer token if authentication is enabled on the OTel Source.

Use gRPC (port 4317) ​

Set environment variables using gRPC. This is the recommended method:

export OTEL_EXPORTER_OTLP_ENDPOINT="http://<cribl-host>:4317"
export OTEL_EXPORTER_OTLP_PROTOCOL="grpc"
export OTEL_SERVICE_NAME="my-grok-app"

# Only if you enabled auth on the Cribl OTEL Source:
export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer <token>"

Use HTTP/protobuf (port 4318) ​

If your OTLP exporter or network path requires HTTP/protobuf instead of gRPC, use port 4318 and set the protocol as shown. If TLS is enabled on your Cribl OTel Source, use https:// instead of http://.

export OTEL_EXPORTER_OTLP_ENDPOINT="http://<cribl-host>:4318"
export OTEL_EXPORTER_OTLP_PROTOCOL="http/protobuf"
export OTEL_SERVICE_NAME="my-grok-app"

# Only if you enabled auth on the Cribl OTEL Source:
export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer <token>"

Environment Variable Reference ​

Use this table to set OTLP export options, optional auth headers for the Cribl Source, and the xAI API key.

Capture Prompt/Completion Content ​

Enabling content capture may expose sensitive data in your telemetry pipeline. Use Cribl Stream’s masking and redaction functions to sanitize data before routing to downstream destinations.

By default, prompt and completion content is not captured to protect sensitive data. To enable it:

export OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT="true"

Verify Data Flow in Cribl Stream ​

After completing the instrumentation process, confirm OTLP events flow from your instrumented app into Cribl Stream.

1. In Cribl Stream, go to Monitoring > Sources and select your OTel Source.
2. Open the Live Data tab.
3. Select Start Capture.
4. Trigger a request in your Grok application.
5. Confirm that events appear in Live Data for your OTel Source.

Route Data to Cribl Search ​

After Grok OTLP data reaches Cribl Stream, add a Cribl Search Destination so you can explore and investigate LLM telemetry to troubleshoot issues, analyze model behavior, and monitor performance. See the Cribl Search Destination guide for setup instructions.

Common Stream Issues and Fixes ​

If spans are missing or the exporter cannot reach Cribl Stream, use this table to narrow down endpoint, authentication, TLS, library versions, and how instrumentation is loaded.

LLM Telemetry Use Cases ​

With data flowing into Cribl Stream, you can route Grok telemetry to any supported Destination. For example:

• Cribl Search: Search and analyze full-fidelity LLM traces and logs interactively.
• Cribl Lake: Store and search traces natively with partitioning optimized for Cribl Search, so you can query Grok traces at scale without re-ingesting them into a separate system.
• Amazon S3 or other object storage: Archive traces for compliance or long-term analysis using partitioning schemes aligned with Cribl Search, so you can query data in place without moving it.
• OpenTelemetry: Forward LLM traces in standard OTLP format to downstream systems.

To set up routing:

1. Add Routes in Routing > Data Routes to match OTel data and direct it to your chosen Destinations.
2. Go to Processing > Pipelines and create a Pipeline to process data flowing down your Route.
3. Use Functions to enrich, filter, sample, or redact data before delivery. For example:
   • Mask prompt/completion content containing sensitive information.
   • Sample high-volume traces to reduce cost.
   • Aggregate token usage metrics by model or service.

For more detailed LLM telemetry use cases, see LLM Telemetry Use Cases in Cribl.