Teams should use OpenTelemetry to standardize instrumentation at the application layer, then route metrics through the OpenTelemetry Collector before Prometheus stores them. This keeps telemetry vendor-neutral, centralizes processing, and makes it easier to filter, enrich, or reshape metrics consistently across services. The practical goal is to separate collection from storage while preserving Prometheus for querying and alerting.
Why OpenTelemetry and Prometheus Are Paired in Distributed Systems
OpenTelemetry and Prometheus solve different parts of the observability problem. OpenTelemetry gives teams a common way to instrument applications, services, and infrastructure signals, while Prometheus remains strongest as a time-series store and query engine for metrics collection, alerting, and operational visibility. When teams separate instrumentation from storage, they reduce lock-in and make telemetry easier to standardise across a mixed estate. The key point is not replacing Prometheus, but using it more consistently through an ingestion path that can normalise data before it is stored. In practice, many teams only discover the cost of inconsistent metric naming and labels after dashboards and alerts have already diverged across services.
How the Collector Sits Between Instrumentation and Storage
The most practical pattern is to instrument applications with OpenTelemetry SDKs or auto-instrumentation, send telemetry to the OpenTelemetry Collector, and then export the approved metric stream into Prometheus. The Collector acts as the control point for processing, which matters in distributed environments where teams need consistent enrichment, filtering, batching, and transformation before the data lands in Prometheus.
This architecture is useful because it lets teams manage telemetry flow centrally without forcing every service to understand storage-specific details. It also gives platform teams a place to enforce consistency when different languages, frameworks, or deployment models produce slightly different metric shapes. Prometheus can then do what it does best: scrape or ingest metrics, retain them, and support alerting and query patterns that operators already understand.
- Use OpenTelemetry at the application edge so instrumentation conventions stay consistent across services.
- Use the Collector to filter noisy signals, normalise labels, and prevent high-cardinality data from reaching storage unchecked.
- Keep Prometheus focused on querying, alerting, and operational analysis rather than bespoke telemetry shaping.
- Treat the Collector pipeline as a shared platform capability, not a per-team integration shortcut.
The architecture breaks down when teams treat the Collector as optional glue rather than a governed telemetry layer, because inconsistent export paths quickly recreate the same fragmentation they were trying to remove.
Where the Pattern Gets Messy in Real Deployments
Tighter telemetry control often increases platform overhead, so organisations have to balance standardisation against latency, operational complexity, and ownership boundaries. That tradeoff becomes visible when services run across Kubernetes, VMs, and edge-like environments, or when different teams want different retention and alerting behaviours.
One common variation is whether Prometheus scrapes the Collector or receives metrics through an export path. The right choice depends on topology and operational preference, and there is no universal consensus beyond the principle that collection and storage should remain decoupled. Another edge case is high-cardinality telemetry, where even well-formed metrics can become expensive or unreliable if labels explode across tenants, request paths, or dynamically generated dimensions. Teams also need to distinguish between metrics, logs, and traces: OpenTelemetry can carry all three, but Prometheus is still a metrics system, so attempts to force non-metric observability data into the same model usually create confusion rather than clarity. For environments with shared observability pipelines, the strongest designs define what must be transformed centrally and what must remain local to the workload.
If the environment cannot tolerate an additional processing layer, or if each team already runs incompatible collection conventions, the pattern stops being a simplification and becomes another integration boundary to operate.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | 8 — Audit Log Management | Telemetry pipelines support centralized visibility and alerting. |
| Recommendation — Centralise metric handling so telemetry supports consistent detection and review. | ||
| NIST CSF 2.0 | DE.CM — Security Continuous Monitoring | OpenTelemetry plus Prometheus directly supports ongoing monitoring of distributed services. |
| Recommendation — Use telemetry pipelines to maintain continuous monitoring across services. | ||
| MITRE ATT&CK | T1213 — Data from Information Repositories | Central observability stores can reveal operational data if access is weak. |
| Recommendation — Protect telemetry repositories and alert on unusual access to observability data. | ||
Practitioner Guidance
What to prioritise: Standardise instrumentation contracts first, then decide how the Collector will enforce naming, labels, and export rules. That sequence prevents teams from building Prometheus-dependent conventions that are hard to unwind later.
What to verify: Confirm that the Collector is actually normalising telemetry instead of merely relaying it. If it is not changing failure-prone data, filtering noise, or aligning metric shapes across services, it is probably not earning its place in the architecture.
What good looks like: Teams can add services without rewriting dashboard logic, Prometheus receives cleaner and more predictable metrics, and platform owners can explain where telemetry is transformed and who approves those rules.
Practitioner takeaway: The architectural win comes from making telemetry governance explicit at the Collector layer, because that is where distributed teams either achieve consistency or quietly reintroduce drift.
Related resources from NHI Mgmt Group
- How should security teams implement OpenTelemetry tracing in a distributed access proxy without breaking authentication flows?
- How should security teams implement state, nonce, and PKCE together in OIDC flows?
- How should security teams implement SSO and SCIM together in enterprise apps?
- How should security teams implement externalized authorization in distributed applications?