Files
zzg c37dff07b0 Add OTLP ingest and span/log correlation
Decoders for OTLP/HTTP JSON traces and logs, tested against payloads
captured from a real `claude -p` run rather than hand-written fixtures.

Correlation is not a span_id join. Claude Code stamps every content log
record with the ROOT span's id, so joining on span_id piles the entire
transcript onto the root and leaves every interesting span empty -- it
fails while looking like it worked. Instead this joins on typed identity
keys both sides carry: tool_use_id for tool results, request_id for
model responses, falling back to innermost-containing-span by timestamp
for records with no key at all.

Identity attributes (user.email, user.id, account and org ids) are
dropped at ingest by default, before anything reaches disk, with an
opt-in to retain them.

Also handles base64 trace ids from SDKs that ignore the OTLP/JSON hex
mapping, nanosecond timestamps beyond float64's exact integer range,
and span cycles from trace id collisions.
2026-09-15 21:34:34 -07:00

1143 lines
24 KiB
JSON

{
"resourceLogs": [
{
"resource": {
"attributes": [
{
"key": "service.name",
"value": {
"stringValue": "claude-code"
}
},
{
"key": "host.arch",
"value": {
"stringValue": "arm64"
}
},
{
"key": "os.type",
"value": {
"stringValue": "darwin"
}
},
{
"key": "os.version",
"value": {
"stringValue": "25.6.0"
}
},
{
"key": "service.version",
"value": {
"stringValue": "2.1.266"
}
}
],
"droppedAttributesCount": 0
},
"scopeLogs": [
{
"scope": {
"name": "com.anthropic.claude_code.events",
"version": "2.1.266"
},
"logRecords": [
{
"timeUnixNano": "1789532369123000000",
"observedTimeUnixNano": "1789532369123000000",
"body": {
"stringValue": "claude_code.hook_execution_start"
},
"attributes": [
{
"key": "user.id",
"value": {
"stringValue": "0000000000000000000000000000000000000000000000000000000000000000"
}
},
{
"key": "session.id",
"value": {
"stringValue": "6f57a3e3-2553-4f07-bd2d-4919be9f654d"
}
},
{
"key": "organization.id",
"value": {
"stringValue": "11111111-1111-1111-1111-111111111111"
}
},
{
"key": "user.email",
"value": {
"stringValue": "someone@example.com"
}
},
{
"key": "user.account_uuid",
"value": {
"stringValue": "00000000-0000-0000-0000-000000000000"
}
},
{
"key": "user.account_id",
"value": {
"stringValue": "00000000-0000-0000-0000-000000000000"
}
},
{
"key": "terminal.type",
"value": {
"stringValue": "tmux"
}
},
{
"key": "event.name",
"value": {
"stringValue": "hook_execution_start"
}
},
{
"key": "event.timestamp",
"value": {
"stringValue": "2026-09-16T04:19:29.123Z"
}
},
{
"key": "event.sequence",
"value": {
"intValue": 0
}
},
{
"key": "hook_event",
"value": {
"stringValue": "SessionStart"
}
},
{
"key": "hook_name",
"value": {
"stringValue": "SessionStart:startup"
}
},
{
"key": "num_hooks",
"value": {
"stringValue": "1"
}
},
{
"key": "managed_only",
"value": {
"stringValue": "false"
}
},
{
"key": "hook_source",
"value": {
"stringValue": "merged"
}
},
{
"key": "safe_mode",
"value": {
"stringValue": "false"
}
}
],
"droppedAttributesCount": 0
},
{
"timeUnixNano": "1789532369139000000",
"observedTimeUnixNano": "1789532369139000000",
"body": {
"stringValue": "claude_code.hook_registered"
},
"attributes": [
{
"key": "user.id",
"value": {
"stringValue": "0000000000000000000000000000000000000000000000000000000000000000"
}
},
{
"key": "session.id",
"value": {
"stringValue": "6f57a3e3-2553-4f07-bd2d-4919be9f654d"
}
},
{
"key": "organization.id",
"value": {
"stringValue": "11111111-1111-1111-1111-111111111111"
}
},
{
"key": "user.email",
"value": {
"stringValue": "someone@example.com"
}
},
{
"key": "user.account_uuid",
"value": {
"stringValue": "00000000-0000-0000-0000-000000000000"
}
},
{
"key": "user.account_id",
"value": {
"stringValue": "00000000-0000-0000-0000-000000000000"
}
},
{
"key": "terminal.type",
"value": {
"stringValue": "tmux"
}
},
{
"key": "event.name",
"value": {
"stringValue": "hook_registered"
}
},
{
"key": "event.timestamp",
"value": {
"stringValue": "2026-09-16T04:19:29.139Z"
}
},
{
"key": "event.sequence",
"value": {
"intValue": 1
}
},
{
"key": "hook_event",
"value": {
"stringValue": "Stop"
}
},
{
"key": "hook_type",
"value": {
"stringValue": "command"
}
},
{
"key": "hook_source",
"value": {
"stringValue": "userSettings"
}
},
{
"key": "safe_mode",
"value": {
"stringValue": "false"
}
}
],
"droppedAttributesCount": 0
},
{
"timeUnixNano": "1789532369139000000",
"observedTimeUnixNano": "1789532369139000000",
"body": {
"stringValue": "claude_code.hook_registered"
},
"attributes": [
{
"key": "user.id",
"value": {
"stringValue": "0000000000000000000000000000000000000000000000000000000000000000"
}
},
{
"key": "session.id",
"value": {
"stringValue": "6f57a3e3-2553-4f07-bd2d-4919be9f654d"
}
},
{
"key": "organization.id",
"value": {
"stringValue": "11111111-1111-1111-1111-111111111111"
}
},
{
"key": "user.email",
"value": {
"stringValue": "someone@example.com"
}
},
{
"key": "user.account_uuid",
"value": {
"stringValue": "00000000-0000-0000-0000-000000000000"
}
},
{
"key": "user.account_id",
"value": {
"stringValue": "00000000-0000-0000-0000-000000000000"
}
},
{
"key": "terminal.type",
"value": {
"stringValue": "tmux"
}
},
{
"key": "event.name",
"value": {
"stringValue": "hook_registered"
}
},
{
"key": "event.timestamp",
"value": {
"stringValue": "2026-09-16T04:19:29.139Z"
}
},
{
"key": "event.sequence",
"value": {
"intValue": 2
}
},
{
"key": "hook_event",
"value": {
"stringValue": "MessageDisplay"
}
},
{
"key": "hook_type",
"value": {
"stringValue": "command"
}
},
{
"key": "hook_source",
"value": {
"stringValue": "userSettings"
}
},
{
"key": "safe_mode",
"value": {
"stringValue": "false"
}
}
],
"droppedAttributesCount": 0
},
{
"timeUnixNano": "1789532369139000000",
"observedTimeUnixNano": "1789532369139000000",
"body": {
"stringValue": "claude_code.hook_registered"
},
"attributes": [
{
"key": "user.id",
"value": {
"stringValue": "0000000000000000000000000000000000000000000000000000000000000000"
}
},
{
"key": "session.id",
"value": {
"stringValue": "6f57a3e3-2553-4f07-bd2d-4919be9f654d"
}
},
{
"key": "organization.id",
"value": {
"stringValue": "11111111-1111-1111-1111-111111111111"
}
},
{
"key": "user.email",
"value": {
"stringValue": "someone@example.com"
}
},
{
"key": "user.account_uuid",
"value": {
"stringValue": "00000000-0000-0000-0000-000000000000"
}
},
{
"key": "user.account_id",
"value": {
"stringValue": "00000000-0000-0000-0000-000000000000"
}
},
{
"key": "terminal.type",
"value": {
"stringValue": "tmux"
}
},
{
"key": "event.name",
"value": {
"stringValue": "hook_registered"
}
},
{
"key": "event.timestamp",
"value": {
"stringValue": "2026-09-16T04:19:29.139Z"
}
},
{
"key": "event.sequence",
"value": {
"intValue": 3
}
},
{
"key": "hook_event",
"value": {
"stringValue": "SessionStart"
}
},
{
"key": "hook_type",
"value": {
"stringValue": "command"
}
},
{
"key": "hook_source",
"value": {
"stringValue": "pluginHook"
}
},
{
"key": "safe_mode",
"value": {
"stringValue": "false"
}
},
{
"key": "plugin.name",
"value": {
"stringValue": "superpowers"
}
},
{
"key": "plugin_id_hash",
"value": {
"stringValue": "a218113d2400f77d"
}
},
{
"key": "hook_matcher",
"value": {
"stringValue": "startup|clear|compact"
}
}
],
"droppedAttributesCount": 0
},
{
"timeUnixNano": "1789532369139000000",
"observedTimeUnixNano": "1789532369139000000",
"body": {
"stringValue": "claude_code.plugin_loaded"
},
"attributes": [
{
"key": "user.id",
"value": {
"stringValue": "0000000000000000000000000000000000000000000000000000000000000000"
}
},
{
"key": "session.id",
"value": {
"stringValue": "6f57a3e3-2553-4f07-bd2d-4919be9f654d"
}
},
{
"key": "organization.id",
"value": {
"stringValue": "11111111-1111-1111-1111-111111111111"
}
},
{
"key": "user.email",
"value": {
"stringValue": "someone@example.com"
}
},
{
"key": "user.account_uuid",
"value": {
"stringValue": "00000000-0000-0000-0000-000000000000"
}
},
{
"key": "user.account_id",
"value": {
"stringValue": "00000000-0000-0000-0000-000000000000"
}
},
{
"key": "terminal.type",
"value": {
"stringValue": "tmux"
}
},
{
"key": "event.name",
"value": {
"stringValue": "plugin_loaded"
}
},
{
"key": "event.timestamp",
"value": {
"stringValue": "2026-09-16T04:19:29.139Z"
}
},
{
"key": "event.sequence",
"value": {
"intValue": 4
}
},
{
"key": "plugin.name",
"value": {
"stringValue": "superpowers"
}
},
{
"key": "marketplace.name",
"value": {
"stringValue": "claude-plugins-official"
}
},
{
"key": "plugin.version",
"value": {
"stringValue": "6.3.0"
}
},
{
"key": "plugin.scope",
"value": {
"stringValue": "official"
}
},
{
"key": "enabled_via",
"value": {
"stringValue": "user-install"
}
},
{
"key": "plugin_id_hash",
"value": {
"stringValue": "a218113d2400f77d"
}
},
{
"key": "has_hooks",
"value": {
"boolValue": true
}
},
{
"key": "has_mcp",
"value": {
"boolValue": false
}
},
{
"key": "host_owned_mcp",
"value": {
"boolValue": false
}
},
{
"key": "skill_path_count",
"value": {
"intValue": 1
}
},
{
"key": "command_path_count",
"value": {
"intValue": 0
}
},
{
"key": "agent_path_count",
"value": {
"intValue": 0
}
},
{
"key": "safe_mode",
"value": {
"stringValue": "false"
}
}
],
"droppedAttributesCount": 0
},
{
"timeUnixNano": "1789532369139000000",
"observedTimeUnixNano": "1789532369139000000",
"body": {
"stringValue": "claude_code.plugin_loaded"
},
"attributes": [
{
"key": "user.id",
"value": {
"stringValue": "0000000000000000000000000000000000000000000000000000000000000000"
}
},
{
"key": "session.id",
"value": {
"stringValue": "6f57a3e3-2553-4f07-bd2d-4919be9f654d"
}
},
{
"key": "organization.id",
"value": {
"stringValue": "11111111-1111-1111-1111-111111111111"
}
},
{
"key": "user.email",
"value": {
"stringValue": "someone@example.com"
}
},
{
"key": "user.account_uuid",
"value": {
"stringValue": "00000000-0000-0000-0000-000000000000"
}
},
{
"key": "user.account_id",
"value": {
"stringValue": "00000000-0000-0000-0000-000000000000"
}
},
{
"key": "terminal.type",
"value": {
"stringValue": "tmux"
}
},
{
"key": "event.name",
"value": {
"stringValue": "plugin_loaded"
}
},
{
"key": "event.timestamp",
"value": {
"stringValue": "2026-09-16T04:19:29.139Z"
}
},
{
"key": "event.sequence",
"value": {
"intValue": 5
}
},
{
"key": "plugin.name",
"value": {
"stringValue": "swift-testing-pro"
}
},
{
"key": "marketplace.name",
"value": {
"stringValue": "skills-dir"
}
},
{
"key": "plugin.version",
"value": {
"stringValue": "1.0.0"
}
},
{
"key": "plugin.scope",
"value": {
"stringValue": "user-local"
}
},
{
"key": "enabled_via",
"value": {
"stringValue": "user-install"
}
},
{
"key": "plugin_id_hash",
"value": {
"stringValue": "86f1a5b550c1d6b6"
}
},
{
"key": "has_hooks",
"value": {
"boolValue": false
}
},
{
"key": "has_mcp",
"value": {
"boolValue": false
}
},
{
"key": "host_owned_mcp",
"value": {
"boolValue": false
}
},
{
"key": "skill_path_count",
"value": {
"intValue": 1
}
},
{
"key": "command_path_count",
"value": {
"intValue": 0
}
},
{
"key": "agent_path_count",
"value": {
"intValue": 1
}
},
{
"key": "safe_mode",
"value": {
"stringValue": "false"
}
}
],
"droppedAttributesCount": 0
},
{
"timeUnixNano": "1789532369139000000",
"observedTimeUnixNano": "1789532369139000000",
"body": {
"stringValue": "claude_code.plugin_loaded"
},
"attributes": [
{
"key": "user.id",
"value": {
"stringValue": "0000000000000000000000000000000000000000000000000000000000000000"
}
},
{
"key": "session.id",
"value": {
"stringValue": "6f57a3e3-2553-4f07-bd2d-4919be9f654d"
}
},
{
"key": "organization.id",
"value": {
"stringValue": "11111111-1111-1111-1111-111111111111"
}
},
{
"key": "user.email",
"value": {
"stringValue": "someone@example.com"
}
},
{
"key": "user.account_uuid",
"value": {
"stringValue": "00000000-0000-0000-0000-000000000000"
}
},
{
"key": "user.account_id",
"value": {
"stringValue": "00000000-0000-0000-0000-000000000000"
}
},
{
"key": "terminal.type",
"value": {
"stringValue": "tmux"
}
},
{
"key": "event.name",
"value": {
"stringValue": "plugin_loaded"
}
},
{
"key": "event.timestamp",
"value": {
"stringValue": "2026-09-16T04:19:29.139Z"
}
},
{
"key": "event.sequence",
"value": {
"intValue": 6
}
},
{
"key": "plugin.name",
"value": {
"stringValue": "swift-concurrency-pro"
}
},
{
"key": "marketplace.name",
"value": {
"stringValue": "skills-dir"
}
},
{
"key": "plugin.version",
"value": {
"stringValue": "1.0.0"
}
},
{
"key": "plugin.scope",
"value": {
"stringValue": "user-local"
}
},
{
"key": "enabled_via",
"value": {
"stringValue": "user-install"
}
},
{
"key": "plugin_id_hash",
"value": {
"stringValue": "aa4de94904e58b3d"
}
},
{
"key": "has_hooks",
"value": {
"boolValue": false
}
},
{
"key": "has_mcp",
"value": {
"boolValue": false
}
},
{
"key": "host_owned_mcp",
"value": {
"boolValue": false
}
},
{
"key": "skill_path_count",
"value": {
"intValue": 1
}
},
{
"key": "command_path_count",
"value": {
"intValue": 0
}
},
{
"key": "agent_path_count",
"value": {
"intValue": 1
}
},
{
"key": "safe_mode",
"value": {
"stringValue": "false"
}
}
],
"droppedAttributesCount": 0
},
{
"timeUnixNano": "1789532369206000000",
"observedTimeUnixNano": "1789532369206000000",
"body": {
"stringValue": "claude_code.hook_execution_complete"
},
"attributes": [
{
"key": "user.id",
"value": {
"stringValue": "0000000000000000000000000000000000000000000000000000000000000000"
}
},
{
"key": "session.id",
"value": {
"stringValue": "6f57a3e3-2553-4f07-bd2d-4919be9f654d"
}
},
{
"key": "organization.id",
"value": {
"stringValue": "11111111-1111-1111-1111-111111111111"
}
},
{
"key": "user.email",
"value": {
"stringValue": "someone@example.com"
}
},
{
"key": "user.account_uuid",
"value": {
"stringValue": "00000000-0000-0000-0000-000000000000"
}
},
{
"key": "user.account_id",
"value": {
"stringValue": "00000000-0000-0000-0000-000000000000"
}
},
{
"key": "terminal.type",
"value": {
"stringValue": "tmux"
}
},
{
"key": "event.name",
"value": {
"stringValue": "hook_execution_complete"
}
},
{
"key": "event.timestamp",
"value": {
"stringValue": "2026-09-16T04:19:29.206Z"
}
},
{
"key": "event.sequence",
"value": {
"intValue": 7
}
},
{
"key": "hook_event",
"value": {
"stringValue": "SessionStart"
}
},
{
"key": "hook_name",
"value": {
"stringValue": "SessionStart:startup"
}
},
{
"key": "num_hooks",
"value": {
"stringValue": "1"
}
},
{
"key": "num_success",
"value": {
"stringValue": "1"
}
},
{
"key": "num_blocking",
"value": {
"stringValue": "0"
}
},
{
"key": "num_non_blocking_error",
"value": {
"stringValue": "0"
}
},
{
"key": "num_cancelled",
"value": {
"stringValue": "0"
}
},
{
"key": "total_duration_ms",
"value": {
"stringValue": "74"
}
},
{
"key": "managed_only",
"value": {
"stringValue": "false"
}
},
{
"key": "hook_source",
"value": {
"stringValue": "merged"
}
},
{
"key": "safe_mode",
"value": {
"stringValue": "false"
}
}
],
"droppedAttributesCount": 0
},
{
"timeUnixNano": "1789532369383000000",
"observedTimeUnixNano": "1789532369383000000",
"body": {
"stringValue": "claude_code.mcp_server_connection"
},
"attributes": [
{
"key": "user.id",
"value": {
"stringValue": "0000000000000000000000000000000000000000000000000000000000000000"
}
},
{
"key": "session.id",
"value": {
"stringValue": "6f57a3e3-2553-4f07-bd2d-4919be9f654d"
}
},
{
"key": "organization.id",
"value": {
"stringValue": "11111111-1111-1111-1111-111111111111"
}
},
{
"key": "user.email",
"value": {
"stringValue": "someone@example.com"
}
},
{
"key": "user.account_uuid",
"value": {
"stringValue": "00000000-0000-0000-0000-000000000000"
}
},
{
"key": "user.account_id",
"value": {
"stringValue": "00000000-0000-0000-0000-000000000000"
}
},
{
"key": "terminal.type",
"value": {
"stringValue": "tmux"
}
},
{
"key": "event.name",
"value": {
"stringValue": "mcp_server_connection"
}
},
{
"key": "event.timestamp",
"value": {
"stringValue": "2026-09-16T04:19:29.383Z"
}
},
{
"key": "event.sequence",
"value": {
"intValue": 8
}
},
{
"key": "status",
"value": {
"stringValue": "connected"
}
},
{
"key": "transport_type",
"value": {
"stringValue": "claudeai-proxy"
}
},
{
"key": "server_scope",
"value": {
"stringValue": "claudeai"
}
},
{
"key": "duration_ms",
"value": {
"stringValue": "4"
}
},
{
"key": "is_plugin",
"value": {
"boolValue": false
}
},
{
"key": "server_name",
"value": {
"stringValue": "claude.ai Google Drive"
}
}
],
"droppedAttributesCount": 0
}
]
}
]
}
]
}