OpenTelemetry metrics into Prometheus with OTLP

Prometheus can receive OpenTelemetry metrics directly through its OTLP endpoint, which removes a hop for some estates. This page covers the setup sequence, the naming and attribute decisions, and the failure points that teams hit before go-live.

On this page

OpenTelemetry metrics into Prometheus with OTLP: what the integration does

Prometheus exposes an OTLP receiver for metrics, but the team must enable it, decide how metrics are named and which resource attributes become labels, and configure out-of-order ingestion when several Collector replicas send the same metrics. This section describes what the integration does and where it sits in your monitoring design. If your services already emit OpenTelemetry metrics, the integration lets them reach Prometheus through the OpenTelemetry Collector instead of a separate scrape path for each service. Prometheus still stores the samples and answers PromQL queries, so the pattern changes how metrics arrive, not where they are kept.

OpenTelemetry is a vendor-neutral framework and toolkit for generating, exporting and collecting traces, metrics and logs. The OpenTelemetry Collector receives, processes and exports that telemetry, and it can run as an agent beside services or as a gateway that accepts data from many sources. Neither project is an observability backend. In this design, the Collector sends OTLP metrics to Prometheus, which keeps the time series and serves the queries. Agree on ownership before the first pipeline goes live: the platform team usually owns the Prometheus instance, retention and query access, while application teams own instrumentation and the metric names their code emits.

Prometheus is licensed under Apache-2.0 and has no paid enterprise edition of the project itself, so the cost of this integration comes from infrastructure, storage, implementation and the people who operate it. Ask any partner or internal team to price each of those components separately. Compute for the Prometheus server and the Collector tiers, disk for your retention window, the one-time work of naming conventions and pipeline configuration, and the recurring work of upgrades and alert review are the main items. Prometheus stores data in a local time series database with a default retention of 15 days, so storage grows with series count and retention. Confirm your retention target and expected series count before anyone sizes the disks.

Plan on the LTS 3.13 line. Prometheus long-term support releases receive bug fixes for one year, and the current LTS line is 3.13, released July 1, 2026 and supported until July 31, 2027. Minor releases follow a six-week cycle and generally stop receiving bug fixes after those six weeks, so running a non-LTS minor release means a faster upgrade cadence. LTS 3.5 reached end of life on July 31, 2026, so any plan that starts there is already out of support. Before you commit, confirm which LTS line you will run and read the release notes for the OTLP receiver in that line, since enablement steps and defaults can change between versions.

What you need before enabling OTLP ingestion in Prometheus

Five decisions must be settled before the OTLP endpoint accepts traffic. Each one sets a version, network, storage or security boundary that the rest of the configuration depends on, so record the answers in the design before any sender is switched on.

Choose the Prometheus release line

Decide between the LTS line 3.13, which receives bug fixes until July 31, 2027, and the latest minor release, v3.15.0. Minor releases generally stop receiving bug fixes six weeks after their cycle, so a minor release will need an upgrade within that window to stay supported. Confirm the exact OTLP receiver flag or configuration key for your chosen release in the Prometheus documentation before writing any configuration.

Pin the OpenTelemetry Collector version

Pin the Collector to a known release such as v0.163.0, released October 16, 2026, and record which distribution and builder build you run. Releases ship with signed artifacts, SHA256 checksums and SBOM files, so verify each download against its checksum and signature and keep the SBOM in your software inventory. Confirm component settings against the release notes for the version you pin, and agree on an upgrade cadence before the first pipeline goes live.

Map network paths from senders

List every sender, whether Collector agents beside workloads or gateway Collectors, and the path each one uses to reach Prometheus. Identify which segments cross trust zones, proxies or load balancers, and confirm whether senders connect directly or through a gateway. Decide whether each sender writes to one Prometheus instance or to several, because each instance keeps its own local data. Check firewall rules in both directions for every path before testing.

Plan local storage and retention

Local storage is a single-node time series database organized into two-hour blocks, and it is not clustered or replicated. Size the data volume for your expected sample volume and the retention you choose, starting from the default of 15 days, which can be set by time or size. Plan backups or snapshots for the volume, and decide whether long-term data will go to remote write targets. Ask who owns recovery if the node fails, because a lost volume means lost history unless an external copy exists.

Settle TLS and access decisions

Decide whether the OTLP endpoint uses TLS and whether senders present client certificates. Prometheus supports TLS and client certificate authentication with TLS 1.2 as the minimum, and HTTP basic authentication with bcrypt-hashed passwords, but basic authentication without TLS exposes credentials in cleartext. Prometheus has no built-in single sign-on, so decide who reaches the web UI and API and whether an authenticating reverse proxy sits in front of them. Keep admin and lifecycle endpoints disabled unless an operator needs them.

How the OTLP path differs from scraping Prometheus targets

Prometheus normally pulls. It discovers targets through service discovery or static configuration, then fetches their metrics over HTTP on a schedule it controls. The OTLP path reverses that direction: senders push metrics to Prometheus through its OTLP receiver. That single change affects who holds the endpoint, how targets are found, what happens when a sender is slow or down, and where configuration lives, so the team should settle it before writing any config. A scrape target is something Prometheus can see and check. A pushed sender is something Prometheus only hears from when it sends.

There are two common shapes. In the first, applications or agents send OTLP directly to Prometheus. This is the simplest path with the fewest moving parts, but every sender needs the Prometheus endpoint, and every sender must handle its own retries and buffering. In the second, a Collector runs in agent mode next to workloads or in gateway mode in front of Prometheus, receiving metrics from many sources and forwarding them. The Collector is a vendor-agnostic receiver, processor and exporter, so it can sit between instrumented code and Prometheus without changing the applications. The gateway shape centralizes control, and most teams choose it once more than a handful of services are involved.

In the gateway shape, the Collector is usually where batching, filtering, authentication and retry behavior are set. Batching reduces request overhead, filtering removes series nobody uses, authenticator extensions can check incoming connections and add credentials on outgoing requests, and exporter retry settings decide how much data survives a short Prometheus outage. Teams should confirm which of these the Collector build they plan to use provides, because component stability varies and is documented in each component's README. Confirm the exact component names and options against the Collector configuration documentation for the release you choose, not against examples copied from older guides.

Prometheus is designed to value reliability over precision. Its documentation says it is not a good choice where 100% accuracy is required, such as per-request billing. Pushed metrics do not change that. A gateway can retry and a sender can buffer, but a metric pipeline still samples and aggregates, and a short gap or duplicate can occur during failure recovery. If the use case needs billing-grade accuracy, the team should first ask whether metrics are the right signal at all, and whether that data belongs in logs, traces, or a transactional store with its own reconciliation. Writing that answer down before the build starts avoids rework.

Before writing configuration, decide the shape with the people who will run it. Ask who owns the endpoint, who receives the alert when the gateway backs up, how credentials rotate, and whether applications already emit OTLP or need a Collector to translate. Record the choice in the design document, including the expected number of senders and the failure behavior you accept. Those answers determine the batching, retry, and authentication settings that follow, and they are the basis for any quote or plan an implementation partner produces.

How to connect an OpenTelemetry Collector to Prometheus over OTLP

This sequence connects an OpenTelemetry Collector to a Prometheus server through its OTLP receiver, so metrics arrive as time series you can query and alert on. Each step ends with a check you can run before the next one begins. Confirm every flag and key name against the Prometheus and Collector configuration docs for the versions you run.

  1. Confirm Prometheus and Collector versions

    Record the Prometheus server version and the OpenTelemetry Collector version in the change record, including whether the Collector build is the contrib distribution. Check the Prometheus release cycle, because a minor release generally stops receiving bug fixes once its six-week cycle has passed, while long-term support lines receive fixes for one year. The current LTS line is 3.13, supported until July 31, 2027, and LTS 3.5 has reached end of life. Confirm in the configuration docs for those exact versions that the OTLP receiver and the Collector metrics exporter options exist. Done when both versions are written down and the docs match the configuration you plan to apply.

  2. Enable the OTLP receiver securely

    On the Prometheus server, switch on the OTLP receiver using the option named in the configuration docs for your version. Before any Collector connects, put TLS on the endpoint, using TLS 1.2 as the minimum, and require client certificates or another supported authentication method, because basic authentication without TLS exposes credentials in cleartext. Limit network access so only the Collector hosts can reach the endpoint, and keep administrative API flags disabled. Done when a request from an approved host with valid credentials is accepted, and requests without credentials or from other hosts are refused.

  3. Point the Collector exporter at Prometheus

    In the Collector configuration, add an OTLP exporter set to HTTP that targets the Prometheus receiver address, with the TLS settings and credentials from the previous step. If the endpoint requires authentication, add the matching authenticator extension, such as the oauth2client extension for outgoing requests, and confirm its keys in the Collector configuration docs. Place the exporter in a metrics pipeline with batching enabled, then start or reload the Collector. Done when the Collector log reports successful exports without repeated retries, and a test metric from a sample receiver appears in the Prometheus expression browser with the expected labels.

  4. Set out-of-order ingestion for replicas

    If more than one Collector replica writes the same series, samples can arrive out of time order because each replica flushes on its own schedule. Enable the out-of-order ingestion setting on Prometheus and size its time window to cover your Collector batch and retry delays, confirming the key name and units in the configuration docs for your version. Decide whether replicas should share series or keep them separate, and set resource attributes such as a replica identifier to match that choice. Done when two replicas send the same test metric, the series count matches the number of distinct series you expect, and Prometheus logs show no out-of-order rejections.

  5. Decide the name translation strategy

    OpenTelemetry metric names use dots and carry units separately, while Prometheus names use underscores and may add unit and type suffixes. The name translation strategy controls how that conversion happens, so choose it before any dashboard, recording rule or alert depends on the names, and confirm the strategy names in the docs for your version. Also decide which resource attributes are promoted to labels, because each promoted attribute adds a label to every series it touches. Record both choices in configuration kept under version control. Done when a test metric with a dotted name and unit appears under the translated name you recorded, and a planned alert expression returns data for it.

  6. Verify series counts and retention

    Compare what the Collectors send with what Prometheus stores. Count the distinct test series emitted by each replica, then check the same series in the Prometheus expression browser and on the status page for ingest errors. Confirm timestamps are current and that promoted resource attributes appear as labels. Local storage is not clustered or replicated and keeps data for 15 days by default, so decide on remote write to external long-term storage before relying on longer history. Done when the counts hold steady across a short test run, sample rejections do not grow, and the retention decision is recorded.

How OTLP metric names, attributes and resource data map into Prometheus

This table compares how OTLP metric names, units, resource attributes and instrumentation scope data land in Prometheus, and what each choice changes for PromQL, recording rules and Grafana dashboards. Read each row as a decision to make before enabling the endpoint, and confirm every translation rule against the Prometheus release you run. The main takeaway is that attribute promotion and name strategy determine how much existing query and dashboard work you inherit.

Mapping areaRule or decisionEffect on queries, rules and dashboards
Metric names and unitsNames are translated and units can be added as suffixes. Confirm the exact rules in your release.Alerts and dashboards written for OpenTelemetry names must be rechecked after translation.
Resource attributes such as service name and namespaceKept on the target information series by default. Confirm which attributes become labels in your release.Attributes left off the series need a join at query time, which lengthens PromQL.
Attributes to promote onto each seriesPromote a short allowlist, such as service and namespace, and keep unique identifiers on the target series.Each promoted label multiplies series, so cardinality and storage grow with it.
Target information seriesHolds resource attributes that were not promoted. Confirm how it is written and labeled in your release.Recording rules and dashboard queries must include the join to show these fields.
Instrumentation scope name and versionConfirm whether scope data becomes labels or stays off the series in your release.If scope becomes labels, existing series selectors may match more series than expected.
Name translation strategyChoose between preserved OpenTelemetry-style names and Prometheus-normalized names. Confirm the options your release offers.Preserved names need quoted selectors; normalized names match existing Prometheus conventions.
Counter and histogram suffixesTranslation may add type suffixes to counters and histograms. Confirm the suffixes for each metric type.Alert rules matching exact metric names can break if suffixes change during migration.
Existing dashboards and recording rulesDecide whether to rename, dual-write or migrate, then test each panel against the new names.Run old and new names side by side for a period before retiring the old names.

Why Collector replicas need out-of-order ingestion

When several OpenTelemetry Collector replicas send metrics for the same series to Prometheus over OTLP, the samples do not reliably arrive in timestamp order. Prometheus expects each series to grow forward in time. By default, a sample older than the newest sample it already holds for that series is rejected. Running more than one replica is a common way to get redundancy, so this rejection is a normal outcome of the design unless you configure Prometheus to accept late samples within a bounded window.

Each replica batches and sends on its own schedule, and network delay or retries can make one replica deliver a later sample before another replica delivers an earlier one. Replicas that receive or collect the same workload can also send the same series twice with identical or nearly identical timestamps. In queries, delayed samples appear as gaps that later fill in, and duplicates can show up as doubled lines, jitter or spikes in rate calculations. Prometheus does not deduplicate these for you, so decide early whether duplicates are prevented upstream in the Collector pipeline or tolerated in the data.

Enabling out-of-order ingestion means Prometheus must hold accepted late samples in memory until they are compacted into blocks. A wider out-of-order time window accepts older samples but keeps more data in the head block, which increases memory use. A narrower window protects memory but rejects samples from slow replicas. Set the window using the Prometheus documentation for your release, since the setting and its behavior can change between versions. Then test with the replica count and send interval you plan to run, because no fixed value fits every workload. Confirm the memory headroom under that test load before you choose the value.

Local storage is a single node that is not clustered or replicated, so a larger head and extra memory pressure land on one machine. That affects how you size memory, disk and the retention period (15 days by default, configurable by time or size), and whether you send data onward through remote write. Because Prometheus favors reliability over precision, accept that some late or duplicate samples will be handled rather than perfectly reconciled. Monitor the out-of-order and rejected sample counters that Prometheus exposes, along with OTLP send failures and retries in the Collector, and alert when either rises. Confirm the metric names for your release before you build the dashboards.

How to secure the OTLP path from sender to Prometheus

Metrics sent over OTLP cross several hops: from each sender to the Collector, and from the Collector to Prometheus. Each hop needs its own transport and access decisions, so work through these cards from the Prometheus endpoint outward to the Collector before any sender is connected.

Encrypt the endpoint with TLS

Prometheus supports TLS with TLS 1.2 as the minimum version, so serve the OTLP receiver over TLS with that floor set in the web configuration file. Confirm the minimum version in the configuration you deploy and test the handshake from each sender network segment. Where senders are known and enrolled, require client certificate authentication so that only certificates issued by your internal authority can push metrics. Plan issuance, rotation and revocation with the team that owns your PKI before the first sender connects.

Keep basic authentication behind TLS

Prometheus can check HTTP basic authentication against bcrypt-hashed passwords, but without TLS the username and password travel in cleartext on every request. Accept basic authentication only when the endpoint is served over TLS and each sender reads its password from a secret store. Check whether each sender tool can send a client certificate or a bearer token instead, since either option reduces the number of shared secrets to rotate. Test that plain HTTP requests to the endpoint fail.

Add SSO with an authenticating proxy

Prometheus has no built-in single sign-on, and its security model notes that it has no built-in CSRF protection on mutating endpoints. Place an authenticating reverse proxy in front of the OTLP endpoint, the web UI and the API so that identity checks happen before a request reaches Prometheus. Decide which identity provider the proxy trusts, how it passes identity upstream, and which paths it exposes to machine senders that cannot complete an interactive login. Confirm that the proxy covers every path Prometheus serves.

Disable admin and lifecycle endpoints

Prometheus disables its admin HTTP APIs by default. The --web.enable-admin-api flag turns on destructive operations, and --web.enable-lifecycle enables reload and shutdown endpoints. Leave both off unless an automation job needs them, and if one does, limit that job to a separate listener or to a proxy path with its own authorization rule. Read the running command line in every environment, since a flag set during testing can carry into production. Include this check in your deployment acceptance tests.

Authenticate senders at the Collector

The OpenTelemetry Collector can receive telemetry from many sources and forward it onward, so it is the natural place to check who may send. Its authenticator extensions can authenticate incoming connections on receivers, for example with OIDC, before data enters the pipeline. Choose the authenticator that matches your identity provider, attach it to the OTLP receiver, and test a rejected token alongside an accepted one. Confirm the extension's stability level before relying on it in production.

Send outbound credentials with oauth2client

The oauth2client extension adds credentials to requests the Collector sends onward, such as the OTLP exporter writing to Prometheus. Configure it with the token endpoint and client identity your organization issues to the Collector, and keep the client secret in a secrets store, outside the configuration file. Use the Collector configuration best practices as the hardening reference for the whole pipeline. Check each extension's stability level in its README, since core components have mixed stability, and recheck it at every Collector upgrade.

How to test OTLP ingestion before cutover

Write the acceptance criteria into the scope before anyone sends a test metric. The criteria should name the name translation strategy under test, the promoted resource attributes, the send rate the load test must reach, and the alert rules and Grafana panels that must still resolve. Record who signs off each criterion and what happens if one fails. A test plan without agreed pass conditions tends to end with a debate about whether the results are good enough, so settle that question on paper first.

Start with a known test metric from one sender, such as a single Collector instance emitting a counter with a fixed set of resource and data point attributes. In Prometheus, confirm the series name after translation, the metric type, the labels, and whether each promoted resource attribute appears as a label. Compare the result with the translation rules in your chosen configuration, and check the names with a PromQL query rather than only the explore view. Then repeat the test with a second Collector replica sending the same series. This exposes out-of-order handling and duplicate series behavior, which are the failure modes most likely to surprise a team that has only tested one sender.

Run the load test at the planned send rate for long enough to reach steady state, and watch Prometheus while it runs. Track resident memory, the head series count and how quickly it grows, and the rejected sample counters for out-of-order, too-old and invalid samples. Promoted attributes multiply the number of series, so check the head series figure against the sizing you expect from the attribute cardinality of your real workloads. Confirm the exact metric names for rejected samples in the documentation for your Prometheus version, because the names of these counters have changed across releases. Ask your vendor or the project documentation what head series and memory levels are reasonable for your hardware before you set pass thresholds.

Keep the existing scrape path running in parallel until dashboards and alerts are validated. Point the same alert rules and Grafana queries at both sources, then confirm that each PromQL expression resolves under the chosen name translation and returns the same results within the tolerance your acceptance criteria allow. Check recording rules and any label matchers that depend on the old names. Cutover should happen only when every criterion in the scope has passed and been signed off. If a criterion fails, the scrape path remains the source of truth while the translation strategy, promoted attributes or replica settings are corrected and retested.

Common OTLP ingestion failures and how to fix them

This table pairs each common OTLP ingestion failure with its likely cause and the configuration change or check that resolves it. Match the symptom you see in Collector logs, Prometheus status pages or query results to the first column, then work through the fix column in order. Most failures trace back to three areas: timestamps, endpoint and TLS settings, and how labels and metric names are handled.

SymptomLikely causeFix and check
Samples rejected as out of orderCollector replicas or retries send samples with timestamps older than what Prometheus already stored for the same series, and out-of-order ingestion is not enabled for the OTLP path.Enable out-of-order ingestion for the OTLP path and set its time window to cover the delay you observe between replicas. Confirm the setting name and behavior in the Prometheus docs for your version, then check the rejection counters after the change.
Collector cannot reach the Prometheus endpointThe exporter points at the wrong host, port or path, uses http where the server expects https (or the reverse), or a network policy or firewall blocks the connection from the Collector's network.Check the endpoint from the Collector host with a basic request to the same address and port. Match the scheme and path to the Prometheus listener, then review network policies between the Collector and Prometheus in both directions.
TLS handshake or certificate errorsThe Collector does not trust the CA that signed the Prometheus certificate, the certificate name does not match the host in the endpoint, or the certificate has expired or is not yet valid.Supply the CA bundle to the Collector exporter TLS settings and confirm the server name matches a subject alternative name on the certificate. Inspect the certificate chain and validity dates on the Prometheus side, and avoid disabling verification as a workaround.
Metrics missing or renamed after a translation changeThe name translation strategy changed, so dots in OpenTelemetry names became underscores or unit and type suffixes were added or removed. Existing alert rules and dashboards still query the old names.Record the metric names produced under the current and new strategy on a test instance. Update alert rules, recording rules and dashboard queries to the new names before the change reaches production, and keep the strategy setting in version control.
High cardinality from promoted resource attributesResource attributes such as pod names, container IDs, request identifiers or user-specific values were promoted to labels, so each unique value creates a new series.Promote only a short, agreed list of attributes that identify the workload, such as service name and namespace. Drop or transform high-churn attributes in the Collector before export, then compare active series counts before and after the change.
Duplicate series from Collector replicasSeveral Collector replicas send identical series with the same label set, and nothing distinguishes the senders, so Prometheus receives conflicting or repeated samples.Add an attribute that identifies each replica or source to the exported data, or make the Collector deployment send each series from one place. Check that the series count matches the expected number of targets after the change.
Unexpected dashboards after a Prometheus upgradeThe upgrade changed behavior that affects queries, such as metric naming, default settings or PromQL semantics, or moved the deployment to a release line whose behavior differs from the one the dashboards were built on.Test the dashboards and alert rules against a copy of production data on the target version before upgrading. Review the release notes for the versions you cross, and confirm you are on a supported minor release or long-term support line.
Storage filling faster than plannedSeries growth from promoted attributes or duplicate replicas increases ingestion, and retention is set by time only, while local storage is not replicated and has no built-in capacity limit.Review active series growth and set retention by both time and size so the disk cannot fill. Alert on disk usage with enough lead time to act, and confirm the default retention period and sizing estimates against your own sample volume rather than assumptions.

Questions teams ask before connecting OpenTelemetry to Prometheus

What does it cost to connect OpenTelemetry to Prometheus?

The cost comes from people, infrastructure and storage, not from a Prometheus license. Prometheus is licensed under Apache-2.0 and has no paid enterprise edition of the project itself, so your budget covers four things: the work to connect OpenTelemetry, the servers or cloud capacity that run Prometheus and the Collectors, the storage that holds samples, and the staff who operate the system afterward. One-time costs include design, configuration, testing and handover. Recurring costs include compute, storage growth, upgrades and on-call time. Cost rises with the number of services sending metrics, the number of distinct label combinations they produce, the retention period and whether you need long-term storage elsewhere. Ask for a written scope that separates these components, names who pays for each and states which items recur.

How long does an OTLP integration with Prometheus take?

No duration can be fixed until the scope is written, so ask for a timeline with milestones in the scope document. The main drivers are the number of services and environments to connect, whether a Collector topology already exists or has to be designed, how many metric names and resource attributes need translation decisions, the authentication model for OTLP traffic, storage sizing and retention choices, and how quickly your teams can review test results. Security and change approvals often take longer than the technical work, so include them in the plan. Ask the provider to mark which steps are fixed, which depend on your inputs, and what happens to the schedule if an input arrives late.

Can our in-house team connect OpenTelemetry to Prometheus without a partner?

Yes, if your team already runs Prometheus and OpenTelemetry Collectors and can manage TLS certificates, service discovery and configuration as code. The hardest decisions are rarely the endpoint setting itself. They include how resource attributes become labels, which name translation strategy fits your existing dashboards and alert rules, how out-of-order samples from Collector replicas are handled, and how the setup is tested before production traffic arrives. Assess your team against those skills honestly, and check whether the same people also carry platform on-call duty, since that limits the time they can give to a project. DeployOpen implements this work under a fixed written scope and offers ongoing support as a retainer, so you can choose between building it yourselves, handing it over or sharing the work.

What must our team provide before an OpenTelemetry to Prometheus engagement starts?

Before work starts, your team should provide the Prometheus version you run or plan to run and the Collector distribution and version you use. For Prometheus, the release cycle page lists 3.13 as the current long-term support line, supported until July 31, 2027, which is one input to the version decision. Also provide the network paths from Collectors to Prometheus and the firewall rules that allow them, a certificate authority and certificate policy for TLS, sample services that already emit OpenTelemetry metrics, and acceptance criteria. Acceptance criteria should name the metrics, labels and alert rules that must work and the test that proves each one. Ask the provider to list every input in the written scope with an owner and a due date.

Does OTLP replace scraping in Prometheus?

No. Prometheus still pulls metrics from the targets it discovers, and that model continues for exporters such as the node and blackbox exporters. The OTLP receiver adds a push path for applications and Collectors that send OpenTelemetry metrics to Prometheus. Most estates run both: scraping for infrastructure and existing exporters, and OTLP for instrumented services. Moving a service from scraping to OTLP changes how its metrics arrive, how they are named and which resource attributes they carry, so dashboards and alert rules may need updates. Plan that move service by service, and confirm the receiver's configuration, stability and flags in the Prometheus documentation for the version you choose.

Does DeployOpen provide a compliance attestation for this monitoring setup?

No. DeployOpen does not issue audit reports, attestations or certifications. Its work can prepare the system, its configuration and the evidence an assessor will ask for, such as documented TLS settings, access controls, change records and test results. An independent auditor or certification body decides whether the controls meet a framework's requirements. Before the engagement, confirm with your auditor which framework applies and which controls they expect to see, since that defines the evidence list. Then ask the provider which evidence it will produce, in what format, and who will own it after handover.

Why does Prometheus storage need planning before it receives OTLP metrics?

Storage needs planning because Prometheus keeps samples in a local time series database that is not clustered or replicated, so it should be managed like any single-node database. Data is written in two-hour blocks behind a write-ahead log, and the default retention is 15 days, configurable by time or size. Disk must therefore be sized for your sample rate and retention, and backup and recovery must be designed in advance. If you need longer retention or redundancy, plan remote write to an external long-term storage system. Prometheus also values reliability over precision, so it is a poor fit where every sample must be exact, such as per-request billing. Confirm that requirement before the design is fixed.

How DeployOpen scopes, delivers and supports the OTLP integration

DeployOpen treats OpenTelemetry metrics into Prometheus with OTLP as a planned integration inside infrastructure you control. We start from your collector topology, your Prometheus version and your naming and query requirements, then build and document the pipeline so your team can run it.

How we scope

  • The written scope records which collectors, Prometheus servers and applications are in the OTLP path.
  • It fixes the Prometheus version and the name translation strategy before any configuration is written.
  • It lists which resource attributes are promoted to labels, and which stay on the target info series.

How we build

  • We enable the OTLP receiver on the Prometheus side and configure collectors to export to it.
  • We set out-of-order ingestion only where collector replicas can send samples with overlapping timestamps.
  • We test sample arrival, label shape and PromQL queries against the agreed naming scheme.

How we hand over

  • You receive the collector and Prometheus configuration, with the settings and their reasons recorded.
  • The documentation covers name translation, promoted attributes and known limits of the integration.
  • We walk your operators through the verification steps they will repeat after upgrades or config changes.

How we support

  • Fixed-scope engagements end with agreed deliverables, not open-ended tuning.
  • Ongoing support, upgrades and continuous testing are available as a retainer, scoped in writing.
  • Prometheus upgrades and Collector version changes are planned as separate work, with their own written scope.

Sources and further reading

Talk to our team.

Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.

  • 30-minute call: free, with no obligation.
  • NDA on request: we can sign before you share details.
  • Clear next steps: a scope and plan after the call.