Try it free

Configure OpenTelemetry tracing with Envoy

  • Latest Dynatrace
  • How-to guide
  • 4-min read
Support statement

This integration is based on open source code governed by the respective communities and is not covered under the Dynatrace support policy. While we strive to assist, issues and feature requests should be reported directly to the respective project. Dynatrace cannot ensure fixes/features due to the independent nature of OSS projects.

Always use the most recent release version to ensure you have the latest patches and fixes deployed.

This page describes how to configure your Envoy version 1.30+ instance to export traces to Dynatrace. This lets you monitor traffic flowing through your Envoy proxy directly in Dynatrace.

Prerequisites

  • Envoy 1.30+

  • The OTLP traces URL for the export.

  • The OneAgent Envoy code module is disabled for your environment or host. To do this:

    1. Go to the applicable configuration page:
      • For the entire environment:
        • In Latest Dynatrace, go to Settings Settings > Collect and capture > General monitoring settings > Monitored technologies.
        • In Dynatrace Classic, go to Settings > Monitoring > Monitored technologies.
      • For a particular host, go to Your host > Host settings > General.
    2. Find Envoy in the list of monitored technologies and select Edit.
    3. Select the Monitor Envoy toggle, as appropriate, to turn off the OneAgent Envoy code module.

Configure Envoy tracing

1. Create a Dynatrace access token

  1. In Dynatrace, select Ctrl+K and search for Access tokens.
  2. Select Generate new token.
  3. Give the token a name and add the following scopes:
    • Ingest OpenTelemetry traces (openTelemetryTrace.ingest)
    • Read sampling configuration for Adaptive Traffic Management (adaptiveTrafficManagement.read)
  4. Select Generate token and copy the token value.

For more information, see Dynatrace API - Tokens and authentication.

2. Add the Dynatrace cluster entry

Add the following cluster entry under the top-level clusters key in your Envoy configuration file.

- name: dynatrace-otel
  type: LOGICAL_DNS
  dns_lookup_family: V4_ONLY
  lb_policy: ROUND_ROBIN
  load_assignment:
    cluster_name: dynatrace-otel
    endpoints:
    - lb_endpoints:
      - endpoint:
          address:
            socket_address:
              address: "<your-environment-id>.live.dynatrace.com"
              port_value: 443
  transport_socket:
    name: envoy.transport_sockets.tls
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext

Adaptive Traffic Management

By default, Envoy traces exported via OTLP are not subject to Adaptive Traffic Management (ATM). They count against your included Full-Stack trace volume, and any excess is charged as extended ingest. There is no automatic rate control.

To participate in Adaptive Traffic Management, add the Dynatrace sampler extension (envoy.tracers.opentelemetry.samplers.dynatrace) to your Envoy tracer configuration. The sampler fetches the current adaptive trace sampling rate from the Dynatrace API and applies it to sampling decisions locally in Envoy, keeping trace volume within your licensed Full-Stack trace volume in the same way OneAgent does.

Configuration parameters for the sampler:

  • tenant: Your Dynatrace tenant identifier (available from the Envoy Hub entry setup page).
  • cluster_id: Your Dynatrace cluster ID (available from the Envoy Hub entry setup page).
  • http_service: The Dynatrace API endpoint from which the sampler fetches sampling configuration.
  • root_spans_per_minute: Fallback sampling rate used when the Dynatrace API is unreachable (default: 1000).

For the full proto reference, see the Dynatrace sampler specification in the Envoy documentation.

Envoy traces participating in ATM via the Dynatrace sampler are subject to the environment-wide adaptive trace sampling rate. Per-request HTTP or gRPC sampling rules do not apply to Envoy traces.

1. Configure the OpenTelemetry tracer

Add the following entry to the http_connection_manager filters section of your Envoy configuration file.

tracing:
  random_sampling:
    value: 100
  provider:
    name: envoy.tracers.opentelemetry
    typed_config:
      "@type": type.googleapis.com/envoy.config.trace.v3.OpenTelemetryConfig
      service_name: <your-service-name>
      http_service:
        http_uri:
          uri: "<your-environment-id>.live.dynatrace.com/api/v2/otlp/v1/traces"
          cluster: dynatrace-otel
          timeout: 10s
        request_headers_to_add:
        - header:
            key: "Authorization"
            value: "Api-Token <API_TOKEN>"
      resource_detectors:
        - name: envoy.tracers.opentelemetry.resource_detectors.dynatrace
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.tracers.opentelemetry.resource_detectors.v3.DynatraceResourceDetectorConfig
      sampler:
        name: envoy.tracers.opentelemetry.samplers.dynatrace
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.tracers.opentelemetry.samplers.v3.DynatraceSamplerConfig
          cluster_id: <cluster-id>
          tenant: <your-tenant-id>
          http_service:
            http_uri:
              cluster: "dynatrace-otel"
              uri: "<your-environment-id>.live.dynatrace.com/api/v2/samplingConfiguration"
              timeout: 10s
            request_headers_to_add:
            - header:
                key: "authorization"
                value: "Api-Token <API_TOKEN>"

Replace the following placeholders with the appropriate values:

  • <your-service-name>: Your service's name.
  • <your-environment-id>: Your Dynatrace environment ID. See environment ID to find yours.
  • <API_TOKEN>: The access token you created.
  • <cluster-id>: The numeric ID of your Dynatrace cluster.
  • <your-tenant-id>: The same value as <your-environment-id>.

If you're setting up the integration through the Dynatrace Hub (search for Envoy > select the Hub entry > Set up), the <cluster-id> value is pre-filled in the provided snippet. If you don't have access to this wizard, retrieve the value by sending a GET request to https://<your-environment-id>.live.dynatrace.com/api/v1/config/clusterid with an access token that has the Data Export (DataExport) scope.

For more information, see Dynatrace API - Tokens and authentication.

2. Verify the setup

After the setup is complete and you have ingested your first data, you can verify if the traces show up in Dynatrace.

OpenTelemetry traces visible in Distributed Tracing
OpenTelemetry traces visible in Distributed Tracing

Next steps

To also trace Istio-managed traffic, see Configure OpenTelemetry tracing with Istio.

Related topics

  • Prometheus
  • Istio/Envoy proxy metrics
Related tags
Application Observability