Skip to content

Claude Cowork Integration with Coralogix

Claude Cowork is Anthropic's collaborative AI workspace. It emits OpenTelemetry (OTel) log events natively, giving you full visibility into session activity, token usage, cost estimates, and tool calls in Coralogix. For an overview of Cowork, see the Cowork documentation.

What you need

  • A Coralogix account with a Send-Your-Data API key. In Coralogix, navigate to Settings, then API Keys.
  • Your Coralogix OTLP endpoint: ingress.:443. Use the domain selector at the top of this page to select your region.
  • A Claude for Teams or Enterprise account with Cowork enabled.
  • Claude desktop app version 1.1.4173 or later.

Set up

Configure monitoring in Cowork

  1. In Claude.ai, navigate to Admin Settings, then Cowork.

  2. Under Monitoring, fill in the following fields:

    FieldValue
    OTLP endpointingress.:443
    OTLP protocolhttp/protobuf (also supports http/json)
    OTLP headersAuthorization=Bearer <YOUR_API_KEY>,cx-application-name=<APP_NAME>,cx-subsystem-name=<SUBSYSTEM_NAME>

    Replace <YOUR_API_KEY> with your Send-Your-Data API key, and set <APP_NAME> and <SUBSYSTEM_NAME> to the values you want to use for routing in Coralogix (for example, cowork and cowork-sessions).

    Header format

    The OTLP headers field must be a single line with no spaces around commas. Any extra space or newline will cause ingestion to fail.

  3. Select Save.

    Claude Cowork admin settings showing the monitoring configuration with OTLP endpoint, protocol, and headers fields

Validate the integration

After saving the configuration, start a Cowork session and send a few messages. Then confirm data is flowing in Coralogix:

  1. Navigate to Logs and filter by the application name you configured to see events appear in real time.

Monitor data in Coralogix

Cowork emits log events over OTel. All events appear in Coralogix Logs and can be queried using DataPrime or Lucene, filtered by your application and subsystem names.

Log events

Event typeKey attributes
claude_code.user_promptsession.id, user.account_uuid, prompt.id, prompt content and length
claude_code.api_requestsession.id, prompt.id, model, token counts, cache metrics, cost estimate
claude_code.api_errorsession.id, prompt.id, error message, HTTP status code
claude_code.tool_resultsession.id, prompt.id, tool name, success status, duration, parameters
claude_code.tool_decisionsession.id, prompt.id, tool name, decision, source

Every event carries session.id, organization.id, user.id, user.account_uuid, user.email, and terminal.type. The prompt.id field is a UUID that links all events generated from a single user prompt, enabling end-to-end tracing of a full turn.

Sensitive data

User prompt content is included in claude_code.user_prompt events by default. Tool parameters may also contain sensitive data. Configure a Coralogix Parsing Rule with the Remove Field action to drop fields before indexing if needed.

Troubleshoot

No data appears in Coralogix

Cause: the OTLP headers are incorrectly formatted. Fix: confirm the headers field is a single unbroken line with no spaces around commas and no trailing newline.

Data appears under the wrong application or subsystem

Cause: the cx-application-name or cx-subsystem-name headers were not parsed correctly. Fix: confirm both headers are present in lowercase using the format key=value with commas separating each header.

No data after saving

Cause: the Claude desktop app version is below the minimum required. Fix: update to version 1.1.4173 or later and restart the app.

Need help? Contact Support.
What's new? Find out here.
LLM? Read llms.txt.
Previous Amazon Bedrock
Next Gemini