A Routing Connector is an OpenTelemetry component that sends logs, metrics, or traces to different pipelines based on rules. It supports more precise data handling by evaluating event attributes and forwarding each item to the correct destination, which is useful for security, observability, and compliance workflows.
What the Routing Connector Does in OpenTelemetry
A Routing Connector is not a transformation tool by itself, it is a decision point. It inspects event attributes and then routes logs, metrics, or traces into different pipelines, which lets a platform treat different telemetry classes or security conditions differently without duplicating collection logic.
That routing behavior matters because observability data often has different handling requirements. One stream may need high-retention storage, another may need security review, and a third may be forwarded to a compliance destination with stricter access or processing rules.
How Routing Logic Shapes Telemetry Pipelines
The practical value of routing is that it adds policy-driven branching to the telemetry path. Instead of sending everything to one backend, teams can use attributes such as source, signal type, environment, tenant, or severity to decide where each item should go.
This creates a cleaner separation between operational telemetry and telemetry that needs special handling. For example, a sensitive trace can be sent to a restricted pipeline while routine metrics continue to a lower-cost observability path.
In that sense, the connector supports selective handling, not selective collection. The source system still emits the data once, but the pipeline can distribute it according to downstream needs, which reduces manual filtering and helps preserve consistency in routing decisions.
Why Routing Connectors Matter for Security and Compliance
Routing becomes important when telemetry contains information that should not follow the same path as ordinary observability data. Attribute-based forwarding can help separate security-relevant logs, regulated records, or high-value traces from general-purpose monitoring streams.
That separation is useful because observability platforms often feed multiple consumers at once, and not all consumers should receive the same level of detail. A connector that routes by rule can reduce unnecessary exposure, support data minimisation, and make it easier to apply different retention or review practices to different classes of telemetry.
It also helps when compliance workflows require evidence to be isolated or forwarded to a distinct system of record. The routing decision becomes part of the control plane for telemetry governance, especially when the organisation needs to prove that certain data took a specific path.
Operational Trade-Offs and Failure Conditions
The main trade-off is that routing logic adds another layer of policy to maintain. If rules are too broad, telemetry may be sent to the wrong pipeline; if they are too narrow, important events may bypass the destination where they are expected to be reviewed or retained.
Routing logic also depends on trustworthy attributes. If attributes are inconsistent, incomplete, or manipulated upstream, the connector can make a correct decision on the wrong inputs, which creates visibility gaps rather than solving them.
Because of that, routing connectors work best when teams treat the routing rules as controlled policy, not ad hoc filtering. The quality of the pipeline depends on the quality of the conditions that drive it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.SC-01 — Cyber Supply Chain Risk Management | Routing rules govern where telemetry flows and who receives it. |
| Recommendation — Define routing policy so telemetry is forwarded only to approved destinations. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Routing connectors distribute log and trace events into different pipelines. |
| AU-9 — Protection of Audit Information | Selective routing helps keep sensitive telemetry on restricted paths. | |
| Recommendation — Route audit events to the correct log pipeline based on handling requirements. Segregate sensitive telemetry paths to preserve audit-data protection. | ||
| ISO/IEC 27001:2022 | A.8.15 — Logging | OpenTelemetry routing directly affects how logging data is handled and distributed. |
| Recommendation — Control log routing so sensitive records reach only authorised processing paths. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Routing connectors are part of directing audit data to the right log stores. |
| Recommendation — Centralise and route audit logs into the required monitoring and retention paths. | ||
Practitioner Guidance
What to watch for: Use a routing connector when different telemetry streams genuinely need different destinations, retention, or handling rules. It is most valuable when the routing criteria are stable enough to be governed, reviewed, and tested rather than improvised during incident response.
Governance implication: Ownership should sit with the team responsible for telemetry policy, not just the team running the collector. That owner should be able to explain why each routing rule exists, what data it affects, and which destination receives the result.
Related resources from NHI Mgmt Group
- Should organisations use connector-less deployment for on-prem DSPM where possible?
- What do security teams get wrong about connector credentials in infrastructure automation?
- Why do AI agents with MCP access create more risk than model routing alone?
- How can organisations reduce the identity blast radius of AI tool routing?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org