Skip to main content

Open AI Codex · Via Your OTEL Collector

Already running an OTEL collector? Forward logs + metrics from your collector to Milestone — your collector stays the single egress point and redaction can happen server-side, before the data leaves your network.

Step 1: Add the Milestone exporter​

Drop into your existing collector config:

# Add to your existing otel-collector-config.yaml.

exporters:
  otlphttp/milestone:
    endpoint: https://telemetry.mstone.ai
    headers:
      x-shared-secret: <your-shared-secret>

service:
  pipelines:
    logs:
      exporters: [otlphttp/milestone]
    metrics:
      exporters: [otlphttp/milestone]
Show how to filter / redact sensitive fields

Add an OTTL transform processor with delete_matching_keys to strip prompt / completion / tool-result text before egress. Edit the regexes for whatever attribute names your source emits:

# Add to your otel-collector-config.yaml — strips prompt /
# completion / tool-result text before egress. Adjust the regexes
# for whatever attribute names your source emits.

processors:
  transform/redact:
    log_statements:
      - context: log
        statements:
          - delete_matching_keys(attributes, "^gen_ai\\.request\\.messages")
          - delete_matching_keys(attributes, "^gen_ai\\.completion(\\.|$)")
          - delete_matching_keys(attributes, "^gen_ai\\.prompt")
          - delete_matching_keys(attributes, "^litellm\\.params\\.messages")
          - delete_matching_keys(attributes, "^tool_call_response")
          - delete_matching_keys(attributes, "^metadata\\.(requester_metadata|completion_response|request_body|response_body)")

service:
  pipelines:
    logs:
      processors: [transform/redact, batch]
      exporters: [otlphttp/milestone]
    metrics:
      processors: [batch]
      exporters: [otlphttp/milestone]

Step 2: Point Codex at your collector​

Save to ~/.codex/config.toml on each developer machine — replace <your-otel-collector> with the address of your collector's OTLP/HTTP listener (port 4318):

[otel]
environment = "prod"
log_user_prompt = false

[otel.exporter.otlp-http]
endpoint = "http://<your-otel-collector>:4318/v1/logs"
protocol = "binary"
headers = { }

[otel.metrics_exporter.otlp-http]
endpoint = "http://<your-otel-collector>:4318/v1/metrics"
protocol = "binary"
headers = { }

Set User Identity​

Add to your shell profile (~/.zshrc or ~/.bashrc):

export OTEL_RESOURCE_ATTRIBUTES="user.login=$(whoami),user.email=$(whoami)@<your-company-domain>.com"

Then reload: source ~/.zshrc

Restart Codex​

Close and reopen Codex for settings to take effect.