How Elastic's InfoSec team built a monitoring pipeline for Claude Code and Claude Cowork using their native OTel export capabilities and Elastic's OTel ingestion infrastructure.

Why Elastic's InfoSec team monitors AI agents

What Claude Code and Cowork export via OpenTelemetry

Architecture: Getting the data to Elasticsearch

Option 1: EDOT OTel Gateway (self-managed)

Option 2: Elastic Cloud Managed OTLP Endpoint (no gateway needed)

Custom Elasticsearch mappings and ingest pipelines

Component template

Index template

Ingest pipeline

Configuring telemetry export

Cowork

Security use cases

Beyond OTel: Claude enterprise audit logs

Conclusion

References

Learn how to collect audit log telemetry from Claude Code/Cowork via OTel into Elasticsearch and use it for security analysis.

Claude Code/Cowork monitoring at scale with Otel & Elastic

Monitoring Claude Code/Cowork at scale with OTel in Elastic

Author

Spencer Niemi

Articles

Monitoring Claude Code/Cowork at scale with OTel in Elastic