Telemetry and exports
This is the field-level detail behind Observability →: how to send Agent Stream’s telemetry to your own observability stack, and how to read the usage and rejection data behind the dashboard’s own charts.
Content capture
Log Requests and Log Responses (both off by default, per surface; see Core configuration →) control whether a surface’s request/response content, not just metadata, gets captured for Langfuse tracing and content-capturing integration templates (available there as the REQUEST_CONTENT / RESPONSE_CONTENT template variables). Turning on an export below doesn’t by itself capture bodies: you still need these switches on for the surfaces whose content you want captured.
Exporting to your own stack
Send Agent Stream’s telemetry into an observability stack you already run, instead of relying on the dashboard’s own charts alone. Doing so lets you correlate traces, metrics, and logs with the rest of your systems, in the tools your team already watches, and keep history longer than the dashboard retains it.
- Already run an OTLP-compatible collector (Grafana, Datadog, Honeycomb, and similar) → OpenTelemetry.
- Just need the live gauges (connections, throughput, latency) scraped by a Prometheus server you already operate → Prometheus.
- Live in Langfuse for prompt tracing and evaluation → Langfuse.
- Forwarding events into your own system (a ticketing tool, an internal pipeline, a SIEM) rather than an observability backend → Webhook.
These are independent switches, so nothing stops you from turning on more than one at a time.
OpenTelemetry (OTLP)
Send traces, metrics, and logs to any OTLP-compatible collector.
- Set Transport Protocol to whichever your collector is listening on: gRPC/tonic (default port 4317) or HTTP/protobuf (default port 4318).
- Authenticate to the collector only needs a value when your collector requires a credential; a sidecar collector on a trusted network typically doesn’t.
- 100% is a reasonable Sample Rate to start with on a low-traffic appliance. Lower it if trace volume becomes a cost or storage concern on your collector.
- Export Interval only matters once Enable Metrics Export is on: shorter intervals mean more responsive dashboards on the collector’s side, but more export traffic.
| Field | Default | Description |
|---|---|---|
| Enable OpenTelemetry | Off | Master switch for OTLP export (toggle). |
| OTLP Endpoint (gRPC / HTTP) | Not set | OTLP collector endpoint (host:port or URL, interpreted per Transport Protocol). The dashboard label switches between “OTLP Endpoint (gRPC)” and “OTLP Endpoint (HTTP)” to match the selected transport. |
| Transport Protocol | gRPC | Dropdown: gRPC/tonic or HTTP/protobuf. |
| Authenticate to the collector | None | Optional auth for a customer-managed collector, filled in as its own sub-form (see below). |
| Service Name | Not set | Service name attached to every span/metric. Use a name that identifies this appliance in your collector’s service list. |
| Environment | Not set | Deployment environment label (e.g. production, staging); use whatever convention your existing observability stack already applies to other services. |
| Enable Trace Export | On | Trace export switch (toggle). |
| Sample Rate | 100% | Trace sampling rate, shown as a percentage slider (“Sample Rate: N%”). |
| Enable Metrics Export | Off | Metrics export switch (toggle). |
| Export Interval (seconds) | Not set | Metrics export interval. |
| Enable Log Export | On | Log export switch (toggle). |
A customer-managed collector’s credential, never stored inline:
| Field | Default | Description |
|---|---|---|
| Header Name | Not set | Header sent to the collector, e.g. Authorization or X-Api-Key, depending on what your collector expects. |
| Secret | Not set | The secret holding the credential value, chosen from a secret picker labeled “Secret”. Create it first on the Secrets page using the token or key your collector issued you. |
| Header Value Format | {value} (the secret’s value, unmodified) | Format string interpolated with the resolved secret; use Bearer {value} for bearer-token auth. |
Prometheus
A Prometheus backend maintains live gauges (active connections, unique identities, throughput bytes/sec, connections/minute, average request/response latency) updated from the same telemetry stream, scraped rather than pushed. Prometheus itself holds the history, so this backend keeps no historical snapshot of its own. Point your own Prometheus server’s scrape config at the appliance to start collecting.
Langfuse
A native connector maps a pipe execution to a Langfuse trace + generation via its ingestion API, carrying token usage, cost, and, when content capture is enabled, the request and response content. Configured as an integration of type Langfuse:
Langfuse is a selectable option in the Integration Type dropdown, but the dashboard has no dedicated form for it (unlike email/Slack/webhook/stream, each of which gets its own typed fields). Picking it falls through to a generic, un-typed pair of textareas labeled “Configuration (JSON)” and “Content Template (JSON)”. The operator hand-writes the whole configuration object as JSON, so the host/public key/secret key have no field-level labels of their own:
| Field | Default | Description |
|---|---|---|
host | https://cloud.langfuse.com | Langfuse project base URL. Entered as a key inside the generic “Configuration (JSON)” textarea, not its own labeled field. Use the default unless you self-host Langfuse. |
public_key | Not set | Project public key (HTTP basic-auth username). From your Langfuse project’s own API keys settings. Entered as a key inside the generic “Configuration (JSON)” textarea, not its own labeled field. |
secret_key | Not set | Project secret key (HTTP basic-auth password). From the same Langfuse project API keys settings as the public key. Entered as a key inside the generic “Configuration (JSON)” textarea, not its own labeled field. |
Webhook
A content-capturing webhook is configured as an integration of type Webhook:
| Field | Default | Description |
|---|---|---|
| Webhook URL | Not set | Destination URL (validated against SSRF before every dispatch). Use the ingestion endpoint your receiving system provides. |
The webhook publisher also supports HMAC request signing, custom headers, and message templates, resolved with the same runtime variables (including the request/response content, when content capture is enabled) used across every integration type. See Notifications and alerts → for the full integration shape and the other delivery types (Slack, email, streaming platforms).
Reading the usage and rejection charts
Usage time ranges
The dashboard’s usage charts (spend, tokens, request counts) can plot any window from now back to roughly five years, because Agent Stream keeps this data at several fixed resolutions rather than one raw log. Zooming out to a longer window doesn’t lose accuracy: a coarser point on the chart is always the exact sum of the finer points it covers, so the numbers stay consistent no matter which time range you pick.
Roughly speaking, the finest detail (30-second resolution) is available for the last couple of hours, minute-level detail for the last day, and progressively coarser resolution the further back you look, out to about five years of history. Deleting a surface, member, or team also removes its historical usage data.
Rejection categories
When a request is rejected (by a guardrail, Judge, or Jury stage), the dashboard groups the reason into one of a small, stable set of categories, regardless of which underlying detector produced it, so counts stay comparable across providers and over time:
Prompt Injection · Jailbreak · Toxicity · Hate Speech · Violence · Sexual / NSFW · Self-Harm · PII · Secrets / Credentials · Bias · Policy Violation · Banned Keyword · Off-Topic / Relevancy · Copyright / IP · System Prompt Leak · Sponge / DoS · Hallucination · Redrive (recovered) · Uncategorized
Redrive (recovered) means a Judge/Jury rejection was later recovered by a redrive and the request ultimately succeeded. It’s recorded distinctly from the real content category so the two aren’t conflated. Uncategorized is the fallback when nothing else matches.
Related
- Observability concept: What gets recorded and why, in plain terms.
- Response headers: The per-request
x-agent-stream-*headers derived from the same execution this telemetry captures. - Notifications and alerts: The integration record shape and delivery-type configuration referenced above.
- Cost and usage limits: The budgets and alerts built on this same usage telemetry.
- Guardrails: The Prompt Guard, Judge, and Jury stages whose rejections populate these categories.
Glad to hear it! Please tell us how we can improve more.
Sorry to hear that. Please tell us how we can improve.
Thank you for sharing your feedback so we can improve your experience.