Learn how to instrument LiteLLM and LiteLLM Proxy applications with OpenTelemetry and export large language model (LLM) telemetry via OTLP into Cribl Search. Once your data is in Cribl Search, you can explore and investigate it to troubleshoot issues, analyze model behavior, and monitor performance.

You’ll complete the following high-level steps:

1. Configure an OpenTelemetry (OTel) Source in Cribl Search to receive OTLP data.
2. Instrument your LiteLLM application (Python SDK or Proxy Server) with OpenTelemetry.
3. Explore LLM telemetry use cases in Cribl Search.

Telemetry Captured ​

LiteLLM emits trace spans (and optional metrics or events) with attributes such as:

Semantic conventions follow OpenTelemetry GenAI Semantic Conventions where applicable. Set OTEL_SEMCONV_STABILITY_OPT_IN=gen_ai_latest_experimental to opt in to the latest GenAI semantic conventions.

LiteLLM also emits several attribute families outside the standard GenAI spec. These are useful for Proxy-level visibility but may not be recognized by all OTel backends:

• metadata.*: Proxy key, user, team, and org metadata (for example metadata.user_api_key_team_id).
• llm.* and litellm.*: LiteLLM-specific request fields such as llm.is_streaming and litellm.call_id.
• gen_ai.cost.*: LiteLLM cost breakdown attributes (for example gen_ai.cost.total_cost).
• llm.{provider}.*: Raw provider request and response payload (default mode only; suppressed in semconv mode and when content capture is disabled).

Prerequisites ​

You’ll need:

• Cribl.Cloud Enterprise.
• Search Admin permission or higher.
• Python 3.9+.
• A LiteLLM installation or a running LiteLLM Proxy instance.
• Provider API keys for the models you call through LiteLLM (for example OPENAI_API_KEY, ANTHROPIC_API_KEY, or keys configured in your Proxy config.yaml).

Get Data Into Cribl Search ​

Complete these steps before you instrument your LLM application:

1. Add a lakehouse engine. This provides storage and compute for data you’re going to ingest into Cribl Search.
2. Add a Cribl Search OpenTelemetry Source to start ingesting the data.
3. Set up your Datatype rules to parse and structure the incoming data.
4. Set up your Dataset rules to route ingested events into individual Search Datasets. This will let you scope your queries and control retention.

Add a Lakehouse Engine ​

A lakehouse engine is the storage-and-compute unit in Cribl Search that holds ingested OTLP (and other Source data) until Dataset retention expires. See Lakehouse Engines in Cribl Search to learn how to set up a new lakehouse engine.

Configure the OpenTelemetry (OTel) Source in Cribl Search ​

To receive OTLP from your LLM application directly in Cribl Search, add an OpenTelemetry Source.

1. On the Cribl.Cloud top bar, select Products > Search. Under Data, select Add Source > OpenTelemetry.

2. In the New Source modal, configure the following under General Settings:

   • ID: Unique Source ID across your Cribl.Cloud Workspace. Use letters, numbers, underscores, and hyphens.
   • Description (optional): Describe the Source (for example, OTLP from LLM-instrumented apps).
   • Address: Hostname that your OpenTelemetry collector or agent connects to. You will use this in exporter configuration.
   • Port: Network port to listen on. Defaults to 4317 for gRPC and 4318 for HTTP (OTLP standard). Change if you use a custom port.
   • OTLP version: Version that matches your upstream sender (default 1.3.1).
   • Protocol: gRPC (default) or HTTP. This must match your OpenTelemetry exporter.

3. Under Authentication, choose None, Basic, Basic (Credentials Secret), Auth Tokens, or Auth Token (Text Secret) as required. See Set up Authentication.

4. Under Encrypt, enable TLS and set the minimum TLS version when senders must connect over TLS. See Set Up Encryption.

5. Select Save to create the Source.

Set Datatype Rules ​

Next, configure Datatype rules to parse, filter, and normalize your data into structured fields.

On the Cribl.Cloud top bar, select Products > Search > Data > Datatyping (auto). Here, you can:

• Use Auto-Datatyping to parse your data automatically.
• Check for uncategorized data that didn’t match any Datatype rules.
• Handle the uncategorized data by adding custom Datatype rules.

See also:

• Datatypes in Cribl Search
• v2 Datatypes in Cribl Search
• List of Stock v2 Datatypes
• Add a Custom v2 Datatype

Add a Dataset and Set Dataset Rules ​

Next, create a Dataset and add Dataset rules to route parsed events into it.

Add a Dataset ​

1. On the Cribl.Cloud top bar, select Products > Search > Data > Datasets.
2. Select Add Dataset.
3. Enter a unique ID.
4. Optionally add a Description and Tags.
5. Set Dataset Provider to lakehouse.
6. Select the Lakehouse engine that will store the data.
7. Set the Retention period.
8. Select Save.

Set Dataset Rules ​

Dataset rules enable you to route ingested events into individual Search Datasets so you can scope your queries and control retention.

See Organize Your Data for details around how to configure your Dataset rules and plan your Search Datasets based on estimated future storage costs.

Instrument Your Application ​

Select Python SDK or Proxy Server from the tabs. Both paths use LiteLLM’s built-in OpenTelemetry callback to emit OTLP spans into the Source you configured earlier.

LiteLLM OpenTelemetry export is Python-only. Install the OpenTelemetry SDK packages alongside litellm, then enable the otel callback in code or in your Proxy config.yaml. See the LiteLLM OpenTelemetry documentation for the full configuration reference.

pip install litellm opentelemetry-api opentelemetry-sdk opentelemetry-exporter-otlp

pip install "litellm[grpc]"

import litellm

litellm.callbacks = ["otel"]

response = litellm.completion(
    model="gpt-4o-mini",
    messages=[{"role": "user", "content": "Hello!"}],
)
print(response.choices[0].message.content)

python app.py

pip install "litellm[proxy]" opentelemetry-api opentelemetry-sdk opentelemetry-exporter-otlp opentelemetry-instrumentation-fastapi

pip install "litellm[grpc]"

model_list:
  - model_name: gpt-4o-mini
    litellm_params:
      model: openai/gpt-4o-mini
      api_key: os.environ/OPENAI_API_KEY

litellm --config config.yaml

POST /v1/chat/completions          ← HTTP request span
├── auth /v1/chat/completions      ← authentication and key lookup
├── execute_guardrail              ← each guardrail that runs (if configured)
├── chat gpt-4o-mini               ← LLM call with gen_ai.* attributes
└── batch_write_to_db              ← spend and usage written to DB

Set Environment Variables ​

Set these environment variables before running your instrumented application. Replace <cribl-host> with your Cribl host address, and <token> with your Bearer token if authentication is enabled on the OTel Source.

Use gRPC (port 4317) ​

Set environment variables using gRPC. This is the recommended method:

export OTEL_EXPORTER_OTLP_ENDPOINT="http://<cribl-host>:4317"
export OTEL_EXPORTER_OTLP_PROTOCOL="grpc"
export OTEL_SERVICE_NAME="my-litellm-app"

# Only if you enabled auth on the Cribl OTEL Source:
export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer <token>"

Use HTTP/protobuf (port 4318) ​

If your OTLP exporter or network path requires HTTP/protobuf instead of gRPC, use port 4318 and set the protocol as shown.

export OTEL_EXPORTER_OTLP_ENDPOINT="http://<cribl-host>:4318"
export OTEL_EXPORTER_OTLP_PROTOCOL="http/protobuf"
export OTEL_SERVICE_NAME="my-litellm-app"

# Only if you enabled auth on the Cribl OTEL Source:
export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer <token>"

Environment Variable Reference ​

Use this table to set OTLP export options, optional auth headers for the Cribl Source, and LiteLLM-specific toggles.

Capture Prompt/Completion Content ​

Content capture behavior differs between the Python SDK and the Proxy:

• Python SDK: Content is captured by default. To disable it:

export OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT="NO_CONTENT"

You can also set litellm.turn_off_message_logging=True in code to suppress content globally.

• Proxy v2: Content is not captured by default. To enable it:

export OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT="span_only"

Other accepted values are event_only and span_and_event.

When content capture is enabled for the Proxy, use Cribl’s masking and redaction features to sanitize data before it reaches downstream destinations.

Verify Data Flow in Cribl Search ​

After completing the instrumentation process, confirm OTLP events flow from your instrumented app into Cribl Search.

1. On the Cribl.Cloud top bar, select Products > Search > Data > Live Data.
2. Select your OpenTelemetry Source and confirm that events appear while you trigger traffic from your LiteLLM application or Proxy.
3. For full Live Data behavior and troubleshooting, check See Live Data Flow.

Common Search Issues and Fixes ​

LLM Telemetry Use Cases ​

With data flowing into Cribl Search, you can explore and gain visibility towards your LiteLLM telemetry:

• Explore LLM telemetry: Explore your Search Dataset in Cribl Search and query it with KQL. Filter and slice by service, model, provider, environment, token usage, cost signals, and error or status fields.
• Investigate incidents and performance regressions: During elevated errors or latency, investigate your LLM Search Dataset. Use aggregations such as summarize or timestats to break down failures by model, deployment, feature, tenant, or region. Use join or related patterns with infrastructure, gateway, or security Datasets for end-to-end context.
• Build dashboards for LLM usage and cost: Use Cribl Search Dashboards to track requests over time by model or app, token usage and derived cost, error rates by environment or tenant, and latency percentiles (for example P95/P99) plus token distributions and traffic share.
• Automate checks with scheduled searches and notifications: Turn important queries (for example, when estimated LLM cost or error rate crosses a threshold over a time window) into Scheduled Searches and attach Notifications to email, Slack, SNS, webhooks, and other targets.

See more detailed LLM telemetry use cases in Cribl Search.

Learn how to instrument LiteLLM and LiteLLM Proxy applications with OpenTelemetry, export large language model (LLM) telemetry via OTLP, and send it into Cribl Stream. Once data is in Cribl Stream, you can route, mask, and enrich it before it reaches your observability backends.

You’ll complete the following high-level steps:

1. Configure an OpenTelemetry (OTel) Source in Cribl Stream to receive OTLP data.
2. Instrument your LiteLLM application (Python SDK or Proxy Server) with OpenTelemetry.
3. Explore LLM telemetry use cases for Cribl Stream.

Telemetry Captured ​

LiteLLM emits trace spans (and optional metrics or events) with attributes such as:

Semantic conventions follow OpenTelemetry GenAI Semantic Conventions where applicable. Set OTEL_SEMCONV_STABILITY_OPT_IN=gen_ai_latest_experimental to opt in to the latest GenAI semantic conventions.

LiteLLM also emits several attribute families outside the standard GenAI spec. These are useful for Proxy-level visibility but may not be recognized by all OTel backends:

• metadata.*: Proxy key, user, team, and org metadata (for example metadata.user_api_key_team_id).
• llm.* and litellm.*: LiteLLM-specific request fields such as llm.is_streaming and litellm.call_id.
• gen_ai.cost.*: LiteLLM cost breakdown attributes (for example gen_ai.cost.total_cost).
• llm.{provider}.*: Raw provider request and response payload (default mode only; suppressed in semconv mode and when content capture is disabled).

Prerequisites ​

• A Cribl Stream instance (v4.x+) with an OpenTelemetry (OTEL) Source enabled.
• Python 3.9+.
• A LiteLLM installation or a running LiteLLM Proxy instance.
• Provider API keys for the models you call through LiteLLM.

Configure the OpenTelemetry (OTel) Source in Cribl Stream ​

Before instrumenting your LiteLLM app, configure Cribl Stream to receive OTLP data.

Configure an OTel Source ​

You do not need a separate OpenTelemetry Source for each LLM or agent provider. Configure one OTel Source in Cribl Stream and point all instrumented applications at the same endpoint. Per application, only the service name and provider API key typically differ. Use Routes and Pipelines in Cribl Stream to filter and process events by service.name.

To receive OTLP from your LLM application, add or edit an OpenTelemetry Source on your Worker Group as follows.

1. On the top bar, select Products, and then select Cribl Stream. Under Worker Groups, select a Worker Group. Next, you have two options:

   • To configure via QuickConnect, navigate to Routing > QuickConnect (Stream) or Collect (Edge). Select Add Source and select the Source you want from the list, choosing either Select Existing or Add New.
   • To configure via the Routes, select Data > Sources (Stream) or More > Sources (Edge). Select the Source you want. Next, select Add Source.

2. In the New Source modal, configure the following under General Settings:

   • Input ID: Unique ID for this Source. For example, OTel042.
   • Description: Optionally, enter a description.
   • OTLP version: The drop-down offers 0.10.0 and 1.3.1 (default).
   • Protocol: Use the drop-down to choose the protocol matching the data you will ingest: gRPC (default), or HTTP.
   • Address: Enter the hostname/IP to listen on. Defaults to 0.0.0.0 (all addresses, IPv4 format).
   • Port: By default, OTel applications send output to port 4317 when using the gRPC protocol, and port 4318 when using HTTP. This setting defaults to 4317 - you must change it if you set Protocol (below) to HTTP, or you want Cribl Stream to collect data from an OTel application that is using a different port.

   Port 4318 is not available on Cribl-managed Worker Groups in Cribl.Cloud.

   • The Extract spans, Extract metrics, and Extract logs settings are specific to the OpenTelemetry Source. By default, these options are toggled off, allowing Cribl Stream to act as a pass-through that generates a single event for each incoming OTel payload. This is useful when you want to forward complete OTel events to downstream systems, such as persistent storage, without breaking them apart. You can enable these settings to extract and process individual records from within OTel events:
     • Extract spans: Generates an individual event for each span in a trace. Traces typically contain multiple spans.
     • Extract metrics: Generates an individual event for each data point in a metric event. OTel metrics often contain multiple data points per event.
     • Extract logs: Available only when OTLP version is set to 1.3.1. Generates an individual event for each log record. Cribl recommends enabling this option to simplify log transformation and manipulation.
   • Tags: Optionally, add tags to help filter and group Sources within Cribl Stream’s UI. Tags are not included in the event data. Separate tag names using a tab or hard return.

3. Optionally, you can adjust the Authentication, TLS, Persistent Queue Settings, Processing, and Advanced settings, or Connected Destinations.

4. Select Save, then Commit & Deploy.

Instrument Your Application ​

Select Python SDK or Proxy Server from the tabs. Both paths use LiteLLM’s built-in OpenTelemetry callback to emit OTLP spans into the Source you configured earlier.

LiteLLM OpenTelemetry export is Python-only. Install the OpenTelemetry SDK packages alongside litellm, then enable the otel callback in code or in your Proxy config.yaml. See the LiteLLM OpenTelemetry documentation for the full configuration reference.

pip install litellm opentelemetry-api opentelemetry-sdk opentelemetry-exporter-otlp

pip install "litellm[grpc]"

import litellm

litellm.callbacks = ["otel"]

response = litellm.completion(
    model="gpt-4o-mini",
    messages=[{"role": "user", "content": "Hello!"}],
)
print(response.choices[0].message.content)

python app.py

pip install "litellm[proxy]" opentelemetry-api opentelemetry-sdk opentelemetry-exporter-otlp opentelemetry-instrumentation-fastapi

pip install "litellm[grpc]"

model_list:
  - model_name: gpt-4o-mini
    litellm_params:
      model: openai/gpt-4o-mini
      api_key: os.environ/OPENAI_API_KEY

litellm --config config.yaml

POST /v1/chat/completions          ← HTTP request span
├── auth /v1/chat/completions      ← authentication and key lookup
├── execute_guardrail              ← each guardrail that runs (if configured)
├── chat gpt-4o-mini               ← LLM call with gen_ai.* attributes
└── batch_write_to_db              ← spend and usage written to DB

Set Environment Variables ​

Set these environment variables before running your instrumented application. Replace <cribl-host> with your Cribl host address, and <token> with your Bearer token if authentication is enabled on the OTel Source.

Use gRPC (port 4317) ​

Set environment variables using gRPC. This is the recommended method:

export OTEL_EXPORTER_OTLP_ENDPOINT="http://<cribl-host>:4317"
export OTEL_EXPORTER_OTLP_PROTOCOL="grpc"
export OTEL_SERVICE_NAME="my-litellm-app"

# Only if you enabled auth on the Cribl OTEL Source:
export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer <token>"

Use HTTP/protobuf (port 4318) ​

If your OTLP exporter or network path requires HTTP/protobuf instead of gRPC, use port 4318 and set the protocol as shown.

export OTEL_EXPORTER_OTLP_ENDPOINT="http://<cribl-host>:4318"
export OTEL_EXPORTER_OTLP_PROTOCOL="http/protobuf"
export OTEL_SERVICE_NAME="my-litellm-app"

# Only if you enabled auth on the Cribl OTEL Source:
export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer <token>"

Environment Variable Reference ​

Use this table to set OTLP export options, optional auth headers for the Cribl Source, and LiteLLM-specific toggles.

Capture Prompt/Completion Content ​

Content capture behavior differs between the Python SDK and the Proxy:

• Python SDK: Content is captured by default. To disable it:

export OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT="NO_CONTENT"

You can also set litellm.turn_off_message_logging=True in code to suppress content globally.

• Proxy v2: Content is not captured by default. To enable it:

export OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT="span_only"

Other accepted values are event_only and span_and_event.

When content capture is enabled for the Proxy, use Cribl Stream’s masking and redaction functions to sanitize data before routing to downstream destinations.

Verify Data Flow in Cribl Stream ​

After completing the instrumentation process, confirm OTLP events flow from your instrumented app into Cribl Stream.

1. In Cribl Stream, go to Monitoring > Sources and select your OTel Source.
2. Open the Live Data tab.
3. Select Start Capture.
4. Trigger a request in your LiteLLM application or Proxy.
5. Confirm that events appear in Live Data for your OTel Source.

Route Data to Cribl Search ​

After LiteLLM OTLP data reaches Cribl Stream, add a Cribl Search Destination so you can explore and investigate LLM telemetry to troubleshoot issues, analyze model behavior, and monitor performance. See the Cribl Search Destination guide for setup instructions.

Common Stream Issues and Fixes ​

If spans are missing or the exporter cannot reach Cribl Stream, use this table to narrow down endpoint, authentication, TLS, library versions, and how instrumentation is loaded.

LLM Telemetry Use Cases ​

With data flowing into Cribl Stream, you can route LiteLLM telemetry to any supported Destination. For example:

• Cribl Search: Search and analyze full-fidelity LLM traces and logs interactively.
• Cribl Lake: Store and search traces natively with partitioning optimized for Cribl Search, so you can query LiteLLM traces at scale without re-ingesting them into a separate system.
• Amazon S3 or other object storage: Archive traces for compliance or long-term analysis using partitioning schemes aligned with Cribl Search, so you can query data in place without moving it.
• OpenTelemetry: Forward LLM traces in standard OTLP format to downstream systems.

To set up routing:

1. Add Routes in Routing > Data Routes to match OTel data and direct it to your chosen Destinations.
2. Go to Processing > Pipelines and create a Pipeline to process data flowing down your Route.
3. Use Functions to enrich, filter, sample, or redact data before delivery. For example:
   • Mask prompt/completion content containing sensitive information.
   • Sample high-volume traces to reduce cost.
   • Aggregate token usage metrics by model or service.

For more detailed LLM telemetry use cases, see LLM Telemetry Use Cases in Cribl.