The Claude Enterprise Analytics Source in Cribl Stream collects usage and cost reports from Anthropic’s Claude Enterprise Analytics API. Use it when you need token consumption and spend data in Cribl Stream for cost attribution, capacity planning, or observability Pipelines.

Type: Pull | TLS Support: Yes | Event Breaker Support: Yes

TLS is enabled via HTTPS on the Claude Enterprise Analytics REST APIs. The default Event Breaker is the Claude Enterprise Analytics Ruleset.

Prerequisites ​

Before you configure this Source, you need:

• A Cribl Stream deployment (Cloud or self-hosted).
• A Claude Enterprise plan. Engagement and adoption analytics are available on all Enterprise plans. Cost and usage endpoints apply to usage-based Enterprise plans. On seat-based plans they reflect usage credits only.
• An Analytics API key with the read:analytics scope. Only the primary owner can enable public API access and create this key in claude.ai, under Organization settings > API. Admin API keys (sk-ant-admin01-...) and Compliance API keys cannot call these endpoints.
• Network connectivity from Cribl Workers to https://api.anthropic.com over HTTPS (direct or via an HTTP/S proxy).

For plan eligibility, who can create keys, and scopes, see Anthropic’s Analytics APIs and Create an Admin API key documentation.

How the Claude Enterprise Analytics Source Works ​

The Source polls two independent content types, each as its own REST Collector job:

Each job authenticates with your Analytics API key, pages through the selected endpoint, and breaks every metric row into a flat event. The Source keeps only finalized buckets (ending_at <= data_refreshed_at) and drops incomplete tail data. When State tracking is on, it stores data_refreshed_at as a watermark and uses that value as starting_at on the next run.

Configuring a Claude Enterprise Analytics Source ​

1. On the top bar, select Products, and then select Cribl Stream. Under Worker Groups, select a Worker Group. Next, you have two options:
   • To configure via QuickConnect, navigate to Routing > QuickConnect. Select Add Source and select the Source you want from the list, choosing either Select Existing or Add New.
   • To configure via the Routes, select Data > Sources. Select the Source you want. Next, select Add Source.
2. In the Source modal, configure the following under General Settings:
   • Input ID: Enter a unique name for this Source. If you clone it, Cribl Stream appends -CLONE to the original Input ID.
   • Description: Optionally, enter a description (for example, which Worker Group or FinOps Pipeline this instance feeds).
   • API key (text secret): Choose Select local secret or Select global secret, then select or create a stored text secret holding your Analytics API key (read:analytics scope).
   • Tags: Optionally, add UI tags to group this Source in Stream. Tags are not added to events.
3. Under Content Types, configure Usage Report and Cost Report. Each content type runs on its own schedule as a separate collection job. Both are enabled by default. See Content Types.
4. Optionally configure Processing Settings, Retries, and Advanced Settings.
5. Under Connected Destinations, choose Send to Routes and/or QuickConnect depending on how you want data to leave this Source.
6. Select Save, then Commit & Deploy.

Content Types ​

Usage Report and Cost Report are the two collection jobs in the Source modal. Usage Report returns token-consumption events. Cost Report returns spend events. Each appears as a collapsible row with its own toggle. Both are on by default, and at least one must stay enabled. Expand a row to set Request Parameters, Scheduling, and State Tracking.

Request Parameters ​

Request Parameters control how Anthropic aggregates each collection. They set bucket size and which dimensions appear on each event.

• Bucket width: Time bucket size for aggregated results. Smaller buckets yield more events per collection run. Options: Daily (1d) (default), Hourly (1h), Per-minute (1m).
• Group by: Dimensions to break down results. Leave empty to collect a single summed row per time bucket. The API returns a dimension only when you request it. If you omit a dimension, that field is null in the output and you cannot recover it downstream.

Group by options depend on the content type, in this UI order. Usage Report offers 8 dimensions. Cost Report offers those 8 plus Cost type and Token type. Anthropic rejects cost_type and token_type on the usage endpoint.

Scheduling ​

Scheduling controls when each content type collects and how far back the first run goes. Each content type has its own cron, earliest window, and job timeout.

• Cron schedule: When to run this collection job in the Leader’s time zone. Default: 0 */4 * * * (every four hours), which matches the API refresh cadence. Polling more often does not produce new finalized data between refreshes.
• Earliest: Start of the initial collection window, relative to now. Used as the lower bound on the first run before any state exists. Default: -7d@d. Anthropic requires starting_at within the last 365 days and no earlier than 2026-01-01T00:00:00Z. See Earliest Time Syntax.
• Job timeout: Maximum runtime for a single collection job (for example, 30, 45s, 15m). Enter 0 for unlimited time (default: 300).

The Source does not expose a Latest field and does not send ending_at. When ending_at is omitted, Anthropic defaults it to the earlier of now and starting_at plus 31 days, and the requested range can span at most 31 days. A first run with a far-back Earliest value therefore collects at most 31 days from that start. Subsequent runs with State tracking on send starting_at from the last data_refreshed_at watermark.

State Tracking ​

State tracking resumes collection from the last data_refreshed_at watermark so later runs do not replay already finalized buckets.

• State tracking: Toggle to resume from the last watermark between scheduled runs (default: on). When enabled, runs between API refreshes produce zero events until new finalized buckets are available.
• State update expression: JavaScript expression evaluated per event to compute new state. The default tracks the data_refreshed_at watermark reported by the API.
• State merge expression: JavaScript expression that merges state across distributed Workers. The default keeps the most recent watermark.
• Manage state: Select Manage State to view, edit, or delete stored state for this content type. This button is unavailable until you save the Source. See Manage State.

Default expressions:

data_refreshed_at && data_refreshed_at > (state.latestDataRefreshedAt || '') ? {latestDataRefreshedAt: data_refreshed_at} : state

(prevState.latestDataRefreshedAt || '') >= (newState.latestDataRefreshedAt || '') ? prevState : newState

State values must resolve to an object. If an expression does not resolve to an object, Cribl Stream ignores the result.

Processing Settings ​

Event Breakers ​

Event Breaker rulesets: Rulesets that split incoming responses into distinct events before they enter Routes and Pipelines. Claude Enterprise Analytics Ruleset is applied by default, followed by the System Default Rule. That ruleset breaks at data.results, copies parent envelope fields onto each row, sets _time from ending_at, and strips pagination fields. Select Add Ruleset to apply additional rulesets.

Event Breaker buffer timeout (ms): How long the Event Breaker waits for new data before flushing what it has (default 10000).

Fields ​

In this section, you can define new fields or modify existing ones using JavaScript expressions, similar to the Eval function.

• The Field Name can either be a new field (unique within the event) or an existing field name to modify its value.
• The Value is a JavaScript expression (enclosed in quotes or backticks) to compute the field’s value (can be a constant). Select this field’s advanced mode icon (far right) if you’d like to open a modal where you can work with sample data and iterate on results.

This flexibility means you can:

• Add new fields to enrich the event.
• Modify existing fields by overwriting their values.
• Compute logic or transformations using JavaScript expressions.

Pre-Processing ​

In this section’s Pipeline drop-down list, you can select a single existing Pipeline or Pack to process data from this input before the data is sent through the Routes.

Retries ​

Adjust how failed HTTP requests are retried.

Retry type: Backoff (default), Static, or Disabled.

Initial retry interval (ms): Delay before the first retry after a failure. Max 20,000 ms. 0 means retry immediately until Retry limit is reached.

Retry limit: Max retries per failed request (default 5, max 20). 0 disables retries.

Backoff multiplier: Base for exponential backoff (default 2).

Retry HTTP codes: Defaults are 429 and 503. HTTP 410 (expired pagination cursor after a data refresh) is deliberately excluded. Retrying a 410 is not useful, because the cursor expires when Anthropic refreshes the data. The next scheduled run restarts from the same watermark.

Honor Retry-After header: When enabled (default), honor Retry-After up to the product maximum (longer delays may be ignored). Stream logs the delay when applicable.

Retry connection timeout / Retry connection reset: Optionally retry on ETIMEDOUT or ECONNRESET.

Advanced Settings ​

Request timeout (seconds): HTTP request inactivity timeout. Defaults to 300. The UI accepts 0-2400. 0 disables the timeout. Cribl Stream applies a runtime cap of 1800 seconds, so values above 1800 are treated as 1800.

Time to live: How long Collector job artifacts remain on disk and in Job Inspector (default 4h).

Environment: For GitOps, optionally limit this config to a single Git branch.

Connected Destinations ​

Send to Routes: Use the Routing table for conditional routing, filtering, and cloning.

QuickConnect: Send this Source’s output directly to one or more Destinations.

Earliest Time Syntax ​

The Earliest field accepts the following syntax:

[+|-]<time_integer><time_unit>@<snap-to_time_unit>

Syntax reference:

Values without units are interpreted as seconds (for example, -1 = -1s).

Snap-To-Time Syntax ​

@ rounds down from the evaluated time. For example:

• @d - start of the current day.
• +128m@h - forward 128 minutes, then snap back to the hour boundary.

Week/month/quarter/year snaps (@w, @w1-@w6, @mon, @q, @y) behave like other Cribl Stream Collectors.

API Limits ​

The Claude Enterprise Analytics API applies a shared rate limit across keys, not per key. The documented default is 60 requests per minute across endpoints. If Anthropic returns HTTP 429, rely on Retry settings rather than tightening the cron below the four-hour refresh cadence.

Pagination cursors are bound to the query that issued them. The Source keeps bucket_width, group_by[], and the time window stable for a given job, and stops after has_more is false or after 200 pages. Do not expect to change those parameters mid-pagination.

Anthropic reports that cost and usage data is available for dates on or after January 1, 2026. For invoicing-grade totals, query dates at least 30 days in the past after Anthropic’s reconciliation window.

For field definitions, response schemas, and metric notes, see Anthropic’s Claude Enterprise Analytics API documentation.

Proxying Requests ​

To send HTTPS traffic through a corporate proxy, see System Proxy Configuration.

Internal Fields ​

Stream attaches metadata you can read in Functions:

• __collectible - metadata about the collection job.
• __collectStats - per-request statistics.

Troubleshooting ​

The Source’s configuration modal has helpful tabs for troubleshooting:

Live Data: Try capturing live data to see real-time events as they are ingested. On the Live Data tab, click Start Capture to begin viewing real-time data.

Logs: Review and search the logs that provide detailed information about the ingestion process, including any errors or warnings that may have occurred.

You can also view the Monitoring page that provides a comprehensive overview of data volume and rate, helping you identify ingestion issues. Analyze the graphs showing events and bytes in/out over time.

Empty Collection Runs ​

Zero events on a scheduled run is expected when Anthropic has not refreshed data_refreshed_at since the last successful job. Confirm the next run after the four-hour refresh window, and check that State tracking is on.

Response Errors ​

Non-2xx HTTP responses from the configured endpoints are generally treated as errors. Exceptions may apply when only some subtasks fail or when the HTTP client follows redirects (3xx) according to library behavior. See job messages for details.

If authentication fails, confirm that you stored an Analytics API key with read:analytics, not an Admin API key or a Claude Compliance access key. Also confirm that public API access is enabled for your Claude Enterprise plan.