Claude Code

The Claude Code integration collects OpenTelemetry log events emitted by Anthropic Claude Code, the AI coding agent. It provides typed field mappings, an ingest pipeline for structured queries, and security-focused dashboards for tool invocation auditing, cost monitoring, and permission analysis.

Claude Code exports telemetry as OTLP (OpenTelemetry Protocol) logs. Each event represents an action in an agentic session: tool calls (shell commands, file operations, MCP tool invocations), API requests, user prompts, permission decisions, and lifecycle events.

This integration requires Claude Code CLI version 2.1.0 or later, which supports OTLP log export.

Claude Code emits structured OTLP log records during agentic sessions. Each record carries an event name attribute identifying its type (mapped to event.action in ECS), along with event-specific attributes namespaced under claude_code.*. The Elastic Agent receives these events via its built-in OTLP HTTP receiver, applies an ingest pipeline that parses JSON-encoded tool parameters, extracts security-relevant fields, and categorizes events using ECS. The processed events are indexed into the logs-claude_code.events.otel-* data stream.

The integration processes these event types:

• An Elastic deployment running version 9.4.0 or later.
• Claude Code CLI with telemetry enabled (CLAUDE_CODE_ENABLE_TELEMETRY=1).

Claude Code has four environment variables that control how much detail is included in telemetry events:

Enabling these gates provides richer forensic data but indexes potentially sensitive content (commands, file contents, prompts). When a gate is disabled, the corresponding fields are absent from the document — the pipeline handles this gracefully.

Organizations can enforce telemetry and verbosity gates fleet-wide via MDM profiles or the admin console. Managed settings cannot be overridden by user environment variables. This ensures telemetry cannot be silently redirected or disabled on managed devices.

For general instructions on installing integrations and deploying Elastic Agent, refer to the Getting started guide.

Prerequisites: Install this integration in Fleet before sending data. The installation creates the ingest pipeline, field mappings, and dashboards required for processing Claude Code events.

Claude Code exports telemetry via OTLP. There are three deployment paths.

If your Elastic Cloud deployment supports managed OTLP ingestion, point Claude Code directly at the Elastic Cloud OTLP endpoint, no agent or collector infrastructure required. Configure the environment:

export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_LOGS_EXPORTER=otlp
export OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf
export OTEL_EXPORTER_OTLP_ENDPOINT="<your-elastic-cloud-otlp-endpoint>"
export OTEL_RESOURCE_ATTRIBUTES="data_stream.dataset=claude_code.events.otel"
		

The Elastic Agent exposes an OTLP HTTP receiver on port 4318. Configure Claude Code to send events to the agent:

export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_LOGS_EXPORTER=otlp
export OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf
export OTEL_EXPORTER_OTLP_ENDPOINT="http://<agent-host>:4318"
export OTEL_RESOURCE_ATTRIBUTES="data_stream.dataset=claude_code.events.otel"
		

Run the Elastic Distribution of the OpenTelemetry Collector with an otlp receiver and an elasticsearch exporter. Configure the data_stream.dataset resource attribute as above. The collector routes events to logs-claude_code.events.otel-*.

After deploying, run a short Claude Code session with telemetry enabled and confirm events appear in the logs-claude_code.events.otel-* data stream. For example, in Kibana Discover, filter on data_stream.dataset: claude_code.events.otel.

• Verify CLAUDE_CODE_ENABLE_TELEMETRY=1 is set in the environment where Claude Code runs.
• Check that the OTLP endpoint is reachable from the Claude Code host (curl -v http://<agent-host>:4318/v1/logs).
• Confirm the Elastic Agent is running and the integration policy is assigned.

Tool parameters, tool input, and prompt text are gated by environment variables (see Verbosity gates). If these fields are absent, enable the relevant gate. On managed devices, these may be controlled by organizational policy and cannot be overridden locally.

Events with event.kind: pipeline_error and a preserve_original_event tag indicate the ingest pipeline encountered an error (typically malformed JSON in tool_parameters or tool_input). The original event is preserved for inspection.

The ingest pipeline parses JSON-encoded tool parameters and inputs into structured fields for querying:

• tool_parameters (JSON string) → tool_parameters_flattened (flattened object)
• tool_input (JSON string) → tool_input_flattened (flattened object)

It also extracts:

• process.command_line from Bash tool full_command
• mcp_server_name and mcp_tool_name from MCP tool parameters
• file.path from file operation tool parameters
• url.full from web tool parameters

Tool invocation auditing — query all Bash commands executed by a user:

claude_code.tool_name: "Bash" AND event.action: "tool_result"
		

Permission decision analysis — find user_permanent auto-approvals (potential risk signal):

event.action: "tool_decision" AND claude_code.decision_source: "user_permanent"
		

Cost anomaly detection — aggregate cost_usd per user per day to detect unusual spending patterns.

MCP server access monitoring — track which MCP servers users connect to and which tools they invoke:

event.action: "mcp_server_connection" OR (event.action: "tool_result" AND claude_code.tool_name: "mcp_tool")
		

{
    "@timestamp": "2026-06-30T02:43:31.836Z",
    "claude_code": {
        "events": {
            "event": {
                "name": "user_prompt",
                "sequence": 0,
                "timestamp": "2026-06-30T02:43:31.836Z"
            },
            "has_hooks": true,
            "has_mcp": true,
            "organization": {
                "id": "00000000-0000-0000-0000-000000000001"
            },
            "prompt": {
                "id": "11111111-2222-3333-4444-555555555555"
            },
            "prompt_length": 18,
            "prompt_text": "What is 2 plus 2?",
            "session": {
                "id": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
            },
            "terminal": {
                "type": "xterm-256color"
            },
            "user": {
                "account_id": "user_01ExampleAccountId00000",
                "account_uuid": "00000000-1111-2222-3333-444444444444",
                "email": "test@example.com",
                "id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"
            }
        }
    },
    "data_stream": {
        "dataset": "claude_code.events.otel",
        "namespace": "42747",
        "type": "logs"
    },
    "ecs": {
        "version": "9.3.0"
    },
    "event": {
        "action": "user_prompt",
        "agent_id_status": "missing",
        "category": [
            "process"
        ],
        "dataset": "claude_code.events.otel",
        "ingested": "2026-06-30T02:43:41Z",
        "kind": "event",
        "original": "{\"observed_timestamp\":\"1782787411836.690337\",\"@timestamp\":\"1782787411836.681529\",\"resource\":{\"attributes\":{\"service.name\":\"claude-code\",\"service.version\":\"2.1.175\",\"host.arch\":\"amd64\",\"os.type\":\"linux\",\"os.version\":\"6.17.0-14-generic\"}},\"data_stream\":{\"namespace\":\"42747\",\"type\":\"logs\",\"dataset\":\"claude_code.events.otel\"},\"scope\":{\"name\":\"com.anthropic.claude_code.events\",\"version\":\"2.1.175\"},\"event_name\":\"user_prompt\",\"attributes\":{\"user.id\":\"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2\",\"user.account_uuid\":\"00000000-1111-2222-3333-444444444444\",\"terminal.type\":\"xterm-256color\",\"event.name\":\"user_prompt\",\"event.timestamp\":\"2026-06-30T02:43:31.83666166Z\",\"prompt.id\":\"11111111-2222-3333-4444-555555555555\",\"event.sequence\":0,\"user.email\":\"test@example.com\",\"prompt_length\":18,\"elastic.preserve_original_event\":\"true\",\"organization.id\":\"00000000-0000-0000-0000-000000000001\",\"has_mcp\":\"true\",\"user.account_id\":\"user_01ExampleAccountId00000\",\"prompt\":\"What is 2 plus 2?\",\"session.id\":\"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee\",\"has_hooks\":\"true\"},\"body\":{\"text\":\"claude_code.user_prompt\"},\"event\":{},\"_version_type\":\"internal\",\"_index\":\"logs-claude_code.events.otel-42747\",\"_id\":null,\"_version\":-4}",
        "outcome": "unknown",
        "provider": "claude-code",
        "type": [
            "start"
        ]
    },
    "host": {
        "arch": "amd64",
        "architecture": "amd64",
        "os": {
            "platform": "linux",
            "version": "6.17.0-14-generic"
        }
    },
    "observed_timestamp": "2026-06-30T02:43:31.836690337Z",
    "os": {
        "type": "linux",
        "version": "6.17.0-14-generic"
    },
    "related": {
        "user": [
            "test@example.com",
            "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"
        ]
    },
    "resource": {
        "attributes": {
            "host": {
                "arch": "amd64"
            },
            "os": {
                "type": "linux",
                "version": "6.17.0-14-generic"
            },
            "service": {
                "name": "claude-code",
                "version": "2.1.175"
            }
        }
    },
    "scope": {
        "name": "com.anthropic.claude_code.events",
        "version": "2.1.175"
    },
    "service": {
        "name": "claude-code",
        "version": "2.1.175"
    },
    "tags": "preserve_original_event"
}
		

This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.

← →

×

×

×

×

×

×