One small Claude Code job, fixing two failing tests and adding a few boundary tests, produced 181 telemetry records and 289 KB of JSON once Adnan Rahic turned on every content flag. Rahic, who works at Bindplane by Dynatrace, published that run today on the CNCF blog along with the OpenTelemetry Collector config he used to cut the stream down to what a team will read. I like it because nothing in the recipe depends on his company’s product, just the upstream Collector contrib image, version 0.161.0, feeding a Grafana LGTM container.
Six Questions Decide What Gets Stored
Rahic starts from six questions about cost per model, tokens per session and how much of that is cache, which tools fail and how often, whether people reject the agent’s edits, where the latency sits, and what broke. Each answer comes from a counter or a short attribute, and none of them needs prompts, file bodies, or diffs.
His rule is that a field no dashboard, alert, or query reads is “storage you’re paying to index.” Write that rule down before an agent pilot becomes a fleet, when every flag left on gets multiplied by every developer.
Agent Defaults Were Built for One Developer and One Session
The waste shows up in three places. With OTEL_LOG_TOOL_CONTENT on, each tool span gets a tool.output event containing whatever the tool returned, so a 40 KB file read becomes a 40 KB span event. The tool_result and tool_decision log events then repeat the full tool arguments, which for a Write call is the whole file stored a second time.
Metrics get identity instead of content. Every data point is tagged with the session, the user’s ID and email, and two account identifiers, so each new session opens a fresh set of time series that never goes away, and in his test 25 sessions produced 300 series across eight metrics. Rahic says none of that is wrong for one developer watching one session, but it is wrong at 200 sessions a day, and the agent won’t change its defaults for you.
Run Raw and Optimized Side by Side First
One OTLP receiver fans every signal into two pipelines. The raw one gets a service name and a batch processor and nothing else, the optimized one gets the reductions, and both export to the same Grafana so one dashboard can draw them red against green. Because a single receiver feeds both, they see byte-identical input, which is what makes the comparison honest.
A few environment variables turn on Claude Code telemetry and beta tracing and point it at the Collector. In production, Rahic says, the raw exporters would go to object storage or be dropped entirely.
Drop, Delete, Hash, and Trim Each Signal
Logs lose the api_request event entirely, since its model name and request ID live in other signals, which removes roughly a quarter of log records with one short filter.
filter/drop_api_request:
error_mode: ignore
logs:
log_record:
- 'attributes["event.name"] == "api_request"'A transform then deletes six attributes, including the prompt, the response, the tool parameters, and the user’s email, while prompt and response lengths stay so size trends survive. Session and user IDs get hashed, which first made log bytes go up, because a full SHA256 digest is 64 characters replacing a 36-character UUID. Cutting the digest to 16 hex characters fixed it, and log bytes roughly halved.
Metrics are a cardinality problem more than a byte problem. Deleting six attributes from each point takes 300 series down to 12, but Claude Code exports delta temporality, Prometheus wants cumulative, and the delta_to_cumulative processor only accepts points in timestamp order. Rahic batches two seconds of exports, groups them under one resource, stamps every point in the window with one timestamp, and sums them before converting, and the optimized totals match raw within half a percent. One Collector has to see every session for that to work, so behind a load balancer it belongs on a single gateway.
Traces drop the tool.execution child span whenever the tool succeeded, because the parent already records the tool name, duration, and result tokens, and that removes a fifth of trace bytes. Twelve span attributes go, four of them Claude-specific twins of OpenTelemetry’s gen_ai semantic convention fields, so a dashboard that has never heard of Claude Code still understands what’s left. One statement deletes the Bash command string when it looks like it contains an Anthropic, GitHub, or AWS key, and tool content, output, and diffs get capped at 512 characters with a flag marking the cut. Every span survives, and trace bytes roughly halve.
Save Sampling for When Truncation Runs Out
Rahic leaves sampling out on purpose. Agent interactions run for minutes and tail sampling makes its call after a fixed wait, so a tool that fails at minute three can arrive after the verdict. His fallback keeps errors, traces slower than 60 seconds, and 10 percent of everything else, with a 120-second decision window.
To prove nothing he needed went missing, he turns on detailed Collector self-telemetry and charts cardinality, bytes per minute, and record counts per exporter. A second dashboard reads only the optimized stream and answers all six questions from 12 series.
Six Answers Beat a Full Transcript
That first run still sticks with me. One small test fix produced 181 records, and the useful part fit in a dozen series and a few short attributes. Our team at TechForward hasn’t rerun Rahic’s numbers from his local test rig, and Bindplane sells telemetry pipelines for a living. Claude Code also ships source-side switches for session and account IDs on metrics, per Anthropic’s monitoring docs, which help on machines you manage, while the Collector covers every agent that reports to it, managed or not.
When OpenTelemetry reached CNCF graduation in May, we called it perfectly timed for the AI and cloud native complexity explosion, and agent telemetry is that explosion landing in the Collector. Grab Rahic’s full config in the CNCF walkthrough, and if the Collector is new to your team, our look at why OpenTelemetry was the star of 2024 is a good place to start.
