---
title: "Claude Code"
url: "https://axoflow.com/docs/axoflow/data-sources/appliances/anthropic/claude-code/"
description: "Send Anthropic Claude Code logs to Axoflow, and look up the labels that Axoflow adds to its data."
last_modified: "2026-10-27T09:35:49+01:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axoflow/llms.txt).

# Claude Code

Send Anthropic Claude Code logs to Axoflow, and look up the labels that Axoflow adds to its data.

Claude Code:
Agentic coding tool emitting OpenTelemetry audit events for tool use, permissions, hooks, and MCP connections.

## Onboarding

Claude Code sends its events as OpenTelemetry logs. Axoflow classifies only the events that it receives on an [OpenTelemetry connector](https://axoflow.com/docs/axoflow/data-sources/opentelemetry/index.md): data from Claude Code received on other connectors, for example, syslog, isn’t recognized as Claude Code data.

1. [Create an OpenTelemetry connector rule](https://axoflow.com/docs/axoflow/data-sources/opentelemetry/index.md) that creates a connector on the AxoRouter you want to send the data to. By default, the connector receives data on port 4317 using the OTLP/gRPC protocol.
2. On the hosts where Claude Code runs, enable the telemetry of Claude Code and send its logs to the AxoRouter. For example, set the following environment variables:

   ```shell
   export CLAUDE_CODE_ENABLE_TELEMETRY=1
   export OTEL_LOGS_EXPORTER=otlp
   export OTEL_EXPORTER_OTLP_PROTOCOL=grpc
   export OTEL_EXPORTER_OTLP_ENDPOINT=https://<axorouter-address>:4317
   ```

   If the connector doesn’t use TLS, use `http://` in the endpoint.

   To configure every user of your organization at once, set these variables in the managed settings of Claude Code. For details, see the [Claude Code monitoring documentation](https://docs.claude.com/en/docs/claude-code/monitoring-usage).

## Labels

Axoflow automatically adds the following labels to data collected from this source:

| Analytics label | Message field | Value |
| --- | --- | --- |
| `vendor` | [`meta.vendor`](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.vendor) | `anthropic` |
| `product` | [`meta.product`](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.product) | `claude-code` |

You can use the labels as:

- labels in **Customize Graph** on the [Analytics page](https://axoflow.com/docs/axoflow/metrics/analytics/index.md),
- in the **Filter labels** field during [log tapping](https://axoflow.com/docs/axoflow/onboard-hosts/log-tapping/index.md).

You can use the message fields

- in [Flow Processing steps](https://axoflow.com/docs/axoflow/data-management/processing/index.md), for example, in the **Query** field of **Select Messages** steps,
- in AQL expressions in the search bars.

## Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

| sourcetype | index |
| --- | --- |
| `anthropic:claude-code` | `infraops` |

If the Axoflow classification doesn’t set the source field for the message automatically, and you haven’t set it in a [flow processing step](https://axoflow.com/docs/axoflow/data-management/processing/index.md#set-fields) manually (by setting the `meta.destination.splunk.source` field), AxoRouter automatically sets the source to the [name of the AxoRouter connector](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.connector.name) that received the message (for example, `axorouter-syslog-tcp-514`).