Ingest OpenTelemetry Data into Cribl Search
Collect metrics, traces, and logs from OTLP-compliant agents to store them in Cribl Search for fast analysis.
Before You Begin
You’ll need:
- Cribl.Cloud Enterprise. For details, see Pricing.
- Search Admin Permission, or higher. Learn who can do what at Cribl Search Permissions.
- An OpenTelemetry agent or collector that can reach Cribl Search over HTTP(S).
You don’t need Cribl Stream, Edge, or Lake. (Looking for the OpenTelemetry (OTel) Source in Cribl Stream instead?)
1. Add a Lakehouse Engine
See Lakehouse Engines in Cribl Search.
2. Set Up Your Search Datasets
Create the Search Datasets you’ll route events into, and set their retention. See Create Search Datasets.
3. Add an OpenTelemetry Source in Cribl Search
On the Cribl.Cloud top bar, select Products > Search > Data > Add Source > OpenTelemetry.
Describe Your Source and Set the Protocol
Under General, configure:
| Setting | Description | Example |
|---|---|---|
| ID | Source ID, unique across your Cribl.Cloud Workspace. Use letters, numbers, underscores, hyphens. | otel_prod |
| Description | Describe your Source so others know what it’s for. | Ingests OTLP from prod collectors |
| Address | Hostname (FQDN) that your upstream sender connects to. You’ll need this to set up your upstream sender. | search.main.foo-bar-abc123.cribl.cloud |
| Port | Network port to listen on. Keep the default unless it conflicts with another service. | 4317 (gRPC default), 4318 (HTTP default) |
| OTLP version | Version of the OTLP Protobuf spec to use. Choose the version that matches your upstream sender. | 1.3.1 (default) |
| Protocol | The transport protocol to accept: gRPC (default) or HTTP. Choose the protocol that matches your upstream sender. | gRPC (default) |
Set up Authentication
Use authentication to make sure only authorized senders can push data to your Cribl Search Source.
Under Authentication, select the Authentication type you want to use:
No authentication. Use only for testing or trusted internal networks.
Create a username and password. This is what your upstream sender will need to provide when sending data to your Source endpoint.
| Setting | Example |
|---|---|
| Username | otel_user |
| Password | ******** |
Authenticate using a stored credentials secret instead of entering a username and password directly. This keeps credentials out of your Source configuration and makes them easier to rotate.
| Setting | Description | Example |
|---|---|---|
Credentials secret | Reference to a stored text secret that holds the credentials (username and password). Select a secret or Create a new one. (See Create and Manage Secrets in Cribl Stream). | sec_otel_creds |
Create bearer tokens. This is what your upstream sender will need to provide in the authorization header.
Select
Add Token, then enter a token text or Generate a random one.
Authenticate using a stored token secret instead of entering a token text directly. This keeps tokens out of your Source configuration and makes them easier to rotate.
| Setting | Description | Example |
|---|---|---|
Token secret | Reference to a stored text secret that holds the token. Select a secret or Create a new one. (See Create and Manage Secrets in Cribl Stream). | sec_otel_token |
Set Up Encryption
Use TLS encryption to protect your data in transit between upstream senders and your Cribl Search Source.
Under Encrypt, select Enabled, and set the Minimum TLS version you want to accept.
| TLS Version | When to Use |
|---|---|
| 1.3 | Recommended. Provides the best security. |
| 1.2 | Use only when connecting to older systems that don’t support TLS 1.3. |
| Older than 1.2 | Avoid if possible. These versions are no longer considered secure. |
Select Save to create the Source.
4. Set Up Datatyping
Configure Datatype rules to parse, filter, and normalize your data into structured fields. We call this process Datatyping.
On the Cribl.Cloud top bar, select Products > Search > Data > Datatyping (auto). Here, you can:
- Use Auto-Datatyping to parse your data automatically.
- Check for uncategorized data that didn’t match any Datatype rules.
- Handle the uncategorized data by adding custom Datatype rules.
See also:
- Datatypes in Cribl Search
- v2 Datatypes in Cribl Search
- List of Stock v2 Datatypes
- Add a Custom v2 Datatype
5. Set Up Dataset Rules
Configure Dataset rules to route the parsed events into your Search Datasets.
On the Cribl.Cloud top bar, select Products > Search > Data > Datasets: Organize Your Data, and see Organize Data with Dataset Rules for details.
6. Set Up Your OpenTelemetry Sender
Configure your OpenTelemetry collector to export to the Source endpoint.
You’ll need these details from your Source configuration:
| Name | Example |
|---|---|
| Address | search.main.foo-bar-abc123.cribl.cloud |
| Port | 4317 (gRPC default), 4318 (HTTP default) |
| Username / Password Or, Token | otel_user / ********420 |
Examples: OpenTelemetry > Cribl Search
Edit the OpenTelemetry agent or collector’s YAML configuration file, using the following example. For details, see OpenTelemetry docs.
Replace the example address (search.main.foo-bar-abc123.cribl.cloud), token, and port (if you changed the defaults
4317 for gRPC or 4318 for HTTP) with your Source values.
exporters:
otlp:
endpoint: "search.main.foo-bar-abc123.cribl.cloud:4317"
headers:
authorization: "Bearer 420"exporters:
otlphttp:
endpoint: "https://search.main.foo-bar-abc123.cribl.cloud:4318"
headers:
authorization: "Bearer 420"7. Start Sending Data
Start sending events from your upstream OpenTelemetry sender, and verify that they’re successfully flowing into Cribl Search.
On the Cribl.Cloud top bar, select Products > Search > Data > Live Data.
Here, check for your OpenTelemetry Source. For details, see See Live Data Flow.
Next Steps
Now that your data is in Cribl Search, you can start using it. For example: