How to Stream Octopus Audit Logs to Grafana Cloud With OpenTelemetry

Octopus Deploy audit events can be viewed in the Audit tab, streamed externally through Audit Stream, or incorporated into Compliance Reports for governance reporting. The walkthrough describes sending new audit events to Grafana Cloud using OpenTelemetry, with Grafana Alloy acting as an intermediary collector that receives OTLP logs, batches them, securely authenticates to Grafana Cloud, and exports them to Loki for LogQL searches. After configuring an OTLP endpoint, instance ID, API token, and a publicly reachable collector endpoint, users enable the OpenTelemetry Audit Stream in Octopus; only events generated after activation are streamed. In Grafana, events can be filtered by attributes such as category, user, IP address, space, and resource ID, including queries for deletion events. The setup also creates a Grafana alert that counts deletions over a time window and sends Slack notifications identifying the action, user, and source IP. Because Octopus sends standard OTLP data to the collector rather than directly to Grafana, the same approach can be redirected or duplicated to other observability and SIEM platforms such as Datadog, Honeycomb, Elastic, or self-hosted systems.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.