Support authorization header for java OTel SDK

Author: estolfo

config/logstash.yml

@@ -303,6 +303,11 @@
 #
 # otel.metrics.protocol: "grpc"
 #
+# Authorization header for authenticated OTLP endpoints.
+# Examples: "ApiKey xxx" or "Bearer xxx"
+#
+# otel.metrics.authorization_header:
+#
 # Additional resource attributes as comma-separated key=value pairs.
 # These are attached to all exported metrics to identify this Logstash instance.
 # Example: "environment=production,cluster=us-west,team=platform"

logstash-core/lib/logstash/environment.rb

@@ -115,6 +115,7 @@ def self.as_java_range(r)
            Setting::StringSetting.new("otel.metrics.endpoint", "http://localhost:4317"),
           Setting::NumericSetting.new("otel.metrics.interval", 10), # seconds
            Setting::StringSetting.new("otel.metrics.protocol", "grpc", true, ["grpc", "http"]),
+   Setting::NullableStringSetting.new("otel.metrics.authorization_header", nil, false), # e.g., "ApiKey xxx" or "Bearer xxx"
    Setting::NullableStringSetting.new("otel.resource.attributes", nil, false) # key=value,key2=value2 format
   # post_process
   ].each {|setting| SETTINGS.register(setting) }

logstash-core/lib/logstash/instrument/periodic_poller/otel.rb

@@ -35,6 +35,7 @@ module LogStash module Instrument module PeriodicPoller
   #   otel.metrics.endpoint: "http://localhost:4317"
   #   otel.metrics.interval: 10
   #   otel.metrics.protocol: "grpc"
+  #   otel.metrics.authorization_header: "ApiKey xxx"  # or "Bearer xxx"
   #   otel.resource.attributes: "environment=production,cluster=us-west"
   #
   class OTel < Base
@@ -54,7 +55,8 @@ def initialize(metric, agent, settings)
         agent.name,
         settings.get("otel.metrics.interval"),
         settings.get("otel.metrics.protocol"),
-        settings.get("otel.resource.attributes")
+        settings.get("otel.resource.attributes"),
+        settings.get("otel.metrics.authorization_header")
       )
 
       # Take initial snapshot

logstash-core/spec/logstash/instrument/periodic_poller/otel_spec.rb

@@ -55,6 +55,7 @@
       allow(s).to receive(:get).with("otel.metrics.interval").and_return(10)
       allow(s).to receive(:get).with("otel.metrics.protocol").and_return("grpc")
       allow(s).to receive(:get).with("otel.resource.attributes").and_return(nil)
+      allow(s).to receive(:get).with("otel.metrics.authorization_header").and_return(nil)
     end
   end
 
@@ -85,12 +86,65 @@
         "test-node-name",
         10,
         "grpc",
+        nil,
         nil
       ).and_return(otel_service)
 
       otel_poller
     end
 
+    context "with authorization header" do
+      let(:settings) do
+        double("settings").tap do |s|
+          allow(s).to receive(:get).with("otel.metrics.endpoint").and_return("https://apm.example.com")
+          allow(s).to receive(:get).with("otel.metrics.interval").and_return(10)
+          allow(s).to receive(:get).with("otel.metrics.protocol").and_return("http")
+          allow(s).to receive(:get).with("otel.resource.attributes").and_return(nil)
+          allow(s).to receive(:get).with("otel.metrics.authorization_header").and_return("ApiKey my-secret-key")
+        end
+      end
+
+      it "passes authorization_header to OtelMetricsService" do
+        expect(OtelMetricsService).to receive(:new).with(
+          "https://apm.example.com",
+          "test-node-id",
+          "test-node-name",
+          10,
+          "http",
+          nil,
+          "ApiKey my-secret-key"
+        ).and_return(otel_service)
+
+        otel_poller
+      end
+    end
+
+    context "with Bearer token authorization" do
+      let(:settings) do
+        double("settings").tap do |s|
+          allow(s).to receive(:get).with("otel.metrics.endpoint").and_return("https://apm.example.com")
+          allow(s).to receive(:get).with("otel.metrics.interval").and_return(10)
+          allow(s).to receive(:get).with("otel.metrics.protocol").and_return("http")
+          allow(s).to receive(:get).with("otel.resource.attributes").and_return(nil)
+          allow(s).to receive(:get).with("otel.metrics.authorization_header").and_return("Bearer my-bearer-token")
+        end
+      end
+
+      it "passes Bearer token to OtelMetricsService" do
+        expect(OtelMetricsService).to receive(:new).with(
+          "https://apm.example.com",
+          "test-node-id",
+          "test-node-name",
+          10,
+          "http",
+          nil,
+          "Bearer my-bearer-token"
+        ).and_return(otel_service)
+
+        otel_poller
+      end
+    end
+
     it "registers global metrics" do
       expect(otel_service).to receive(:registerObservableCounter).with(
         "logstash.events.in", anything, anything, anything, anything

logstash-core/src/main/java/org/logstash/instrument/metrics/otel/OtelMetricsService.java

@@ -63,20 +63,25 @@ public class OtelMetricsService {
     private final Map<String, ObservableLongGauge> gauges = new ConcurrentHashMap<>();
     private final Map<String, ObservableLongCounter> observableCounters = new ConcurrentHashMap<>();
 
+    private final String authorizationHeader;
+
     /**
      * Creates a new OTel metrics service.
      *
-     * @param endpoint          OTLP endpoint (e.g., "http://localhost:4317")
-     * @param nodeId            Logstash node ID
-     * @param nodeName          Logstash node name
-     * @param intervalSeconds   Export interval in seconds
-     * @param protocol          "grpc" or "http"
-     * @param resourceAttributes Additional resource attributes (comma-separated key=value pairs)
+     * @param endpoint             OTLP endpoint (e.g., "http://localhost:4317")
+     * @param nodeId               Logstash node ID
+     * @param nodeName             Logstash node name
+     * @param intervalSeconds      Export interval in seconds
+     * @param protocol             "grpc" or "http"
+     * @param resourceAttributes   Additional resource attributes (comma-separated key=value pairs)
+     * @param authorizationHeader  Authorization header value (e.g., "ApiKey xxx" or "Bearer xxx"), or null
      */
     public OtelMetricsService(String endpoint, String nodeId, String nodeName,
-                              int intervalSeconds, String protocol, String resourceAttributes) {
+                              int intervalSeconds, String protocol, String resourceAttributes,
+                              String authorizationHeader) {
         LOGGER.info("Initializing OpenTelemetry metrics export to {} (protocol: {}, interval: {}s)",
                 endpoint, protocol, intervalSeconds);
+        this.authorizationHeader = authorizationHeader;
 
         // Build resource attributes
         AttributesBuilder resourceAttrsBuilder = Attributes.builder()
@@ -115,16 +120,22 @@ public OtelMetricsService(String endpoint, String nodeId, String nodeName,
 
     private MetricExporter createExporter(String endpoint, String protocol) {
         if ("http".equalsIgnoreCase(protocol)) {
-            return OtlpHttpMetricExporter.builder()
+            var builder = OtlpHttpMetricExporter.builder()
                     .setEndpoint(endpoint + "/v1/metrics")
-                    .setTimeout(Duration.ofSeconds(10))
-                    .build();
+                    .setTimeout(Duration.ofSeconds(10));
+            if (authorizationHeader != null && !authorizationHeader.isEmpty()) {
+                builder.addHeader("Authorization", authorizationHeader);
+            }
+            return builder.build();
         } else {
             // Default to gRPC
-            return OtlpGrpcMetricExporter.builder()
+            var builder = OtlpGrpcMetricExporter.builder()
                     .setEndpoint(endpoint)
-                    .setTimeout(Duration.ofSeconds(10))
-                    .build();
+                    .setTimeout(Duration.ofSeconds(10));
+            if (authorizationHeader != null && !authorizationHeader.isEmpty()) {
+                builder.addHeader("Authorization", authorizationHeader);
+            }
+            return builder.build();
         }
     }