Claude Code

Send Anthropic Claude Code logs to Axoflow, and look up the labels that Axoflow adds to its data.

Claude Code: Agentic coding tool emitting OpenTelemetry audit events for tool use, permissions, hooks, and MCP connections.

Onboarding

Claude Code sends its events as OpenTelemetry logs. Axoflow classifies only the events that it receives on an OpenTelemetry connector: data from Claude Code received on other connectors, for example, syslog, isn’t recognized as Claude Code data.

Create an OpenTelemetry connector rule that creates a connector on the AxoRouter you want to send the data to. By default, the connector receives data on port 4317 using the OTLP/gRPC protocol.
On the hosts where Claude Code runs, enable the telemetry of Claude Code and send its logs to the AxoRouter. For example, set the following environment variables:
Terminal window
```
export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_LOGS_EXPORTER=otlp
export OTEL_EXPORTER_OTLP_PROTOCOL=grpc
export OTEL_EXPORTER_OTLP_ENDPOINT=https://<axorouter-address>:4317
```
If the connector doesn’t use TLS, use http:// in the endpoint.

To configure every user of your organization at once, set these variables in the managed settings of Claude Code. For details, see the Claude Code monitoring documentation.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label	Message field	Value
`vendor`	`meta.vendor`	`anthropic`
`product`	`meta.product`	`claude-code`

You can use the labels as:

labels in Customize Graph on the Analytics page,
in the Filter labels field during log tapping.

You can use the message fields

in Flow Processing steps, for example, in the Query field of Select Messages steps,
in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype	index
`anthropic:claude-code`	`infraops`

If the Axoflow classification doesn’t set the source field for the message automatically, and you haven’t set it in a flow processing step manually (by setting the meta.destination.splunk.source field), AxoRouter automatically sets the source to the name of the AxoRouter connector that received the message (for example, axorouter-syslog-tcp-514).