Cloud

otlp_http

Send OpenTelemetry traces, logs, and metrics via OTLP/HTTP protocol.

Sends OpenTelemetry telemetry data to a remote collector via OTLP/HTTP protocol.

Accepts batches of Redpanda OTEL v1 messages (spans, log records, or metrics) and converts them to OTLP format for transmission to OpenTelemetry collectors.

Input format

This output expects messages in Redpanda OTEL v1 format (protobuf or JSON, detected automatically) with the following metadata:

otel_signal_type: The signal type (trace, log, or metric)

Messages produced by the otlp_grpc and otlp_http inputs already include this metadata.

Each batch must contain messages of the same signal type. The entire batch is converted to a single OTLP export request and sent via HTTP POST.

Endpoints

The output automatically appends the signal type path to the base endpoint:

Traces: {endpoint}/v1/traces
Logs: {endpoint}/v1/logs
Metrics: {endpoint}/v1/metrics

Content types

The content_type field supports two content types:

protobuf (default): application/x-protobuf
json: application/json

Authentication

This output supports the following authentication methods:

Basic authentication
OAuth v1
OAuth v2 (requires TLS to be enabled)
JWT

Common
Advanced

output:
  label: ""
  otlp_http:
    endpoint: "" # No default (required)
    max_in_flight: 64

output:
  label: ""
  otlp_http:
    endpoint: "" # No default (required)
    content_type: protobuf
    headers: {}
    timeout: 30s
    proxy_url: ""
    follow_redirects: false
    disable_http2: false
    tls:
      enabled: false
      skip_cert_verify: false
      cert_file: ""
      key_file: ""
    tcp:
      connect_timeout: 0s
      keep_alive:
        idle: 15s
        interval: 15s
        count: 9
      tcp_user_timeout: 0s
    oauth:
      enabled: false
      consumer_key: ""
      consumer_secret: ""
      access_token: ""
      access_token_secret: ""
    basic_auth:
      enabled: false
      username: ""
      password: ""
    jwt:
      enabled: false
      private_key_file: ""
      signing_method: ""
      claims: {}
      headers: {}
    oauth2:
      enabled: false
      client_key: ""
      client_secret: ""
      token_url: ""
      scopes: []
      endpoint_params: {}
    max_in_flight: 64

Fields

`basic_auth`

Configure basic authentication for requests from this component.

Type: object

`basic_auth.enabled`

Whether to use basic authentication in requests.

Type: bool

Default: false

`basic_auth.password`

The password to use for authentication. Used together with username for basic authentication.

This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Manage Secrets before adding it to your configuration.

Type: string

Default: ""

`basic_auth.username`

The username of the account credentials to authenticate as. Used together with password for basic authentication.

Type: string

Default: ""

`content_type`

Content type for HTTP requests. Options: 'protobuf' or 'json'.

Type: string

Default: protobuf

Options: protobuf, json

`disable_http2`

Whether or not to disable HTTP/2.

Type: bool

Default: false

`endpoint`

The HTTP endpoint of the remote OTLP collector (without the signal path).

Type: string

`follow_redirects`

Whether to follow redirects, which are responses with 300-399 status codes, from the OTLP endpoint. When disabled, the output does not request the URL in the Location header, and the write fails with an unexpected status error.

Type: bool

Default: false

`headers`

A map of headers to add to the request.

This field supports interpolation functions.

Type: object<string>

Default: {}

# Examples:
headers:
  X-Custom-Header: value
  traceparent: ${! tracing_span().traceparent }

`jwt`

Beta

Configure JSON Web Token (JWT) authentication. This feature is in beta and may change in future releases. JWTs provide secure, stateless authentication between services.

Type: object

`jwt.claims`

A map of claims to include in the JWT. Claims pass the identity of the authenticated entity to the service provider.

Type: object

Default: {}

`jwt.enabled`

Whether to use JWT authentication in requests.

Type: bool

Default: false

`jwt.headers`

Additional key-value pairs to include in the JWT header (optional). These headers provide extra metadata for JWT processing.

Type: object

Default: {}

`jwt.private_key_file`

Path to a file containing the PEM-encoded private key using PKCS#1 or PKCS#8 format. The private key must be compatible with the algorithm specified in the signing_method field.

Type: string

Default: ""

`jwt.signing_method`

The cryptographic algorithm used to sign the JWT. Supported algorithms are RS256, RS384, RS512, and EdDSA. This algorithm must be compatible with the private key specified in the private_key_file field.

Type: string

Default: ""

`max_in_flight`

The maximum number of messages to have in flight at a given time. For outputs that send messages in batches, this limit applies to message batches. Increase this value to improve throughput.

Type: int

Default: 64

`oauth`

Configure OAuth version 1.0 authentication for secure API access.

Type: object

`oauth.access_token`

The value used to gain access to the protected resources on behalf of the user.

Type: string

Default: ""

`oauth.access_token_secret`

The secret that establishes ownership of the access_token in OAuth 1.0 authentication.

This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Manage Secrets before adding it to your configuration.

Type: string

Default: ""

`oauth.consumer_key`

The value used to identify this component or client to the service provider.

Type: string

Default: ""

`oauth.consumer_secret`

The secret that establishes ownership of the consumer key in OAuth 1.0 authentication.

This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Manage Secrets before adding it to your configuration.

Type: string

Default: ""

`oauth.enabled`

Whether to enable OAuth version 1.0 authentication for requests.

Type: bool

Default: false

`oauth2`

Configures authentication with OAuth version 2 using the client credentials token flow. To exchange a refresh token instead, add a grant_type parameter with the value refresh_token and a refresh_token parameter with the token to endpoint_params.

Type: object

`oauth2.client_key`

A value used to identify the client to the token provider.

Type: string

Default: ""

`oauth2.client_secret`

The secret used to establish ownership of the client key.

This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Manage Secrets before adding it to your configuration.

Type: string

Default: ""

`oauth2.enabled`

Whether to use OAuth version 2 in requests.

Type: bool

Default: false

`oauth2.endpoint_params`

A map of optional parameters to send to the token provider with client credentials token requests. Each value must be an array of strings.

Type: object

Default: {}

# Examples:
endpoint_params:
  audience:
    - https://example.com
  resource:
    - https://api.example.com

`oauth2.scopes[]`

A list of requested permissions (optional).

Type: array<string>

Default: []

`oauth2.token_url`

The URL of the token provider.

Type: string

Default: ""

`proxy_url`

An optional HTTP proxy URL.

Type: string

Default: ""

`tcp`

Configure TCP socket-level settings to optimize network performance and reliability. These low-level controls are useful for:

Unresponsive hosts: Set connect_timeout to limit how long a connection attempt can take (the default 0s sets no limit)
Long-lived connections: Configure keep_alive settings to detect and recover from stale connections
Unstable networks: Tune keep-alive probes to balance between quick failure detection and avoiding false positives
Linux systems with specific requirements: Use tcp_user_timeout (Linux 2.6.37+) to control data acknowledgment timeouts

Most users should keep the default values. Only modify these settings if you’re experiencing connection stability issues or have specific network requirements.

Type: object

`tcp.connect_timeout`

Maximum amount of time a dial will wait for a connect to complete. Zero disables.

Type: string

Default: 0s

`tcp.keep_alive`

TCP keep-alive probe configuration.

Type: object

`tcp.keep_alive.count`

Maximum unanswered keep-alive probes before dropping the connection. Zero defaults to 9.

Type: int

Default: 9

`tcp.keep_alive.idle`

Duration the connection must be idle before sending the first keep-alive probe. Zero defaults to 15s. Negative values disable keep-alive probes.

Type: string

Default: 15s

`tcp.keep_alive.interval`

Duration between keep-alive probes. Zero defaults to 15s.

Type: string

Default: 15s

`tcp.tcp_user_timeout`

Maximum time to wait for acknowledgment of transmitted data before killing the connection. Linux-only (kernel 2.6.37+), ignored on other platforms. When enabled, keep_alive.idle must be greater than this value per RFC 5482. Zero disables.

Type: string

Default: 0s

`timeout`

Timeout for HTTP requests.

Type: string

Default: 30s

`tls`

TLS configuration for HTTP client.

Type: object

`tls.cert_file`

Path to the TLS certificate file for client authentication.

Type: string

Default: ""

`tls.enabled`

Enable TLS connections.

Type: bool

Default: false

`tls.key_file`

Path to the TLS key file for client authentication.

Type: string

Default: ""

`tls.skip_cert_verify`

Skip certificate verification (insecure).

Type: bool

Default: false

Was this helpful?

group Ask in the community

mail Share your feedback

What do you think of this page?

Let us know more:

Let us contact you about your feedback:

otlp_http

Input format

Endpoints

Content types

Authentication

Fields

basic_auth

basic_auth.enabled

basic_auth.password

basic_auth.username

content_type

disable_http2

endpoint

follow_redirects

headers

jwt

jwt.claims

jwt.enabled

jwt.headers

jwt.private_key_file

jwt.signing_method

max_in_flight

oauth

oauth.access_token

oauth.access_token_secret

oauth.consumer_key

oauth.consumer_secret

oauth.enabled

oauth2

oauth2.client_key

oauth2.client_secret

oauth2.enabled

oauth2.endpoint_params

oauth2.scopes[]

oauth2.token_url

proxy_url

tcp

tcp.connect_timeout

tcp.keep_alive

tcp.keep_alive.count

tcp.keep_alive.idle

tcp.keep_alive.interval

tcp.tcp_user_timeout

timeout

tls

tls.cert_file

tls.enabled

tls.key_file

tls.skip_cert_verify

`basic_auth`

`basic_auth.enabled`

`basic_auth.password`

`basic_auth.username`

`content_type`

`disable_http2`

`endpoint`

`follow_redirects`

`headers`

`jwt`

`jwt.claims`

`jwt.enabled`

`jwt.headers`

`jwt.private_key_file`

`jwt.signing_method`

`max_in_flight`

`oauth`

`oauth.access_token`

`oauth.access_token_secret`

`oauth.consumer_key`

`oauth.consumer_secret`

`oauth.enabled`

`oauth2`

`oauth2.client_key`

`oauth2.client_secret`

`oauth2.enabled`

`oauth2.endpoint_params`

`oauth2.scopes[]`

`oauth2.token_url`

`proxy_url`

`tcp`

`tcp.connect_timeout`

`tcp.keep_alive`

`tcp.keep_alive.count`

`tcp.keep_alive.idle`

`tcp.keep_alive.interval`

`tcp.tcp_user_timeout`

`timeout`

`tls`

`tls.cert_file`

`tls.enabled`

`tls.key_file`

`tls.skip_cert_verify`