---
url: https://docs.realmsec.info/integration/cloud_otlp.md
---

# Cloud OTLP Integration

Realm exposes an OpenTelemetry Protocol (OTLP) endpoint that OpenTelemetry Collectors, agents, and SDKs can send log records to directly. Each Cloud OTLP input feed gets its own HTTPS endpoint and bearer token, so you can route OTLP logs into Realm without additional middleware.

> **Note:** Cloud OTLP accepts OTLP over **HTTP** only. gRPC is not supported, so configure your exporter to use OTLP/HTTP (for example, the `otlphttp` exporter in the OpenTelemetry Collector).

## Prerequisites

1. Access to the Realm Security console.
2. An OpenTelemetry Collector, agent, or SDK that can export logs over OTLP/HTTP and reach Realm Cloud on port `443`.

## Create a Source in Realm

1. In Realm, go to **Sources > Add Source**.
2. Enter a name for your source.
3. Set **Product Format** to match the logs being forwarded. Cloud OTLP is available for **Custom CEF**, **Custom CSV**, **Custom JSON**, **Custom Syslog**, and **Jenkins OTLP**.
4. Click **Save**.

## Add a Cloud OTLP Input Feed

1. On the **Select Transport Method** step in the Add Source flow, or from the source page, click **Add Input Feed**.
2. Select **Cloud OTLP** and give it a name.
3. Configure the input feed:
   > **Token:** `<your token>` *(optional — leave empty to have Realm generate one)*\
   > **TLS Issuer:** `Public` or `Realm Private CA`
4. Click **Add**. Realm displays the connection details for the new input feed.

> **Note:** Use **Public** unless your OTLP client requires a private trust chain. Clients connecting to a **Public** endpoint only need up-to-date system CA certificates.

## View Connection Details

1. Click **`...` > View** on the Cloud OTLP input feed.
2. Copy the connection details:
   > **Hostname:** `https://<feed-id>.<account-id>.cloud.ingest.realmsec.net`\
   > **Port:** `443`\
   > **Protocol:** `SSL / TLS`
3. If you selected **Realm Private CA**, copy the **Realm CA pem file** and save it to a file on the host running your OTLP client.
4. Click **`...` > Edit** on the input feed, then click the eye icon in the **Token** field to reveal the token value.
5. Copy the **Token**.

> **Important:** Treat the token as a secret. Anyone with the hostname and token can send data to this input feed.

## Configure Your OpenTelemetry Collector

Add an `otlphttp` exporter that points to the Cloud OTLP **Hostname** and sends the **Token** as a bearer token in the `Authorization` header. The `otlphttp` exporter appends `/v1/logs` to the endpoint automatically.

```yaml
exporters:
  otlphttp/realm:
    endpoint: https://<feed-id>.<account-id>.cloud.ingest.realmsec.net
    headers:
      Authorization: "Bearer ${env:REALM_OTLP_TOKEN}"

service:
  pipelines:
    logs:
      receivers: [<your receivers>]
      processors: [<your processors>]
      exporters: [otlphttp/realm]
```

Set the `REALM_OTLP_TOKEN` environment variable for the Collector process instead of writing the token into the config file.

If the input feed uses **Realm Private CA**, point the exporter at the saved certificate:

```yaml
exporters:
  otlphttp/realm:
    endpoint: https://<feed-id>.<account-id>.cloud.ingest.realmsec.net
    headers:
      Authorization: "Bearer ${env:REALM_OTLP_TOKEN}"
    tls:
      ca_file: /path/to/realm-ca.pem
```

After updating the config, reload or restart your OpenTelemetry Collector to apply the changes.

For a complete example using Cloud OTLP, see the [Jenkins OTLP guide](/integration/jenkins_otlp).

## Troubleshooting

**Authentication errors (HTTP 401)**

1. Confirm the `Authorization` header uses the format `Bearer <token>`.
2. Ensure there are no leading or trailing spaces in the token value.

**Connection or protocol errors**

1. Confirm the exporter uses OTLP/HTTP, not gRPC.
2. Confirm the endpoint starts with `https://` and outbound traffic to port `443` is allowed.

**TLS / certificate errors**

1. For **Public** input feeds, ensure the host has up-to-date CA certificates installed.
2. For **Realm Private CA** input feeds, ensure the exporter's `ca_file` points to the Realm CA pem file copied from the input feed.

## Support

If you encounter any issues or require assistance, contact Realm Security support.