From e0a23bce23a9344fa8b5fa70c68a6a85cb7e6026 Mon Sep 17 00:00:00 2001 From: Vishal Rana Date: Tue, 8 Sep 2026 22:19:51 -0700 Subject: [PATCH] docs: match the collector snippet the application generates The Collector example advertised `fanout.example.com:443` while Connect telemetry emits `https://fanout.example.com:443`. Both reach the same instance, but they do not mean the same thing to the exporter: configgrpc strips the scheme before dialling, and an `https://` prefix forces TLS even when `tls.insecure` is set below it. Documenting the weaker form invited a paste that a stray `insecure: true` could silently downgrade. Use the scheme form, and say what each half of the endpoint buys. The port is not advice but a requirement: ClientConfig.Validate splits the sanitized endpoint and rejects one without a port, so a portless endpoint fails at startup rather than dialling somewhere unintended. gRPC's own default of 443 belongs to a resolver path this exporter never reaches. Claude-Session: https://claude.ai/code/session_014UGBcvMuCtZnsTTdVoQgMo --- site/src/content/docs/start/send-telemetry.mdx | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/site/src/content/docs/start/send-telemetry.mdx b/site/src/content/docs/start/send-telemetry.mdx index ca810098..ff2ddfb8 100644 --- a/site/src/content/docs/start/send-telemetry.mdx +++ b/site/src/content/docs/start/send-telemetry.mdx @@ -55,7 +55,7 @@ variables such as `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT` must include their path ```yaml exporters: otlp/fanout: - endpoint: fanout.example.com:443 + endpoint: "https://fanout.example.com:443" headers: Authorization: "Bearer ${env:INGEST_TOKEN}" @@ -69,10 +69,17 @@ service: exporters: [otlp/fanout] ``` -The `otlp` exporter uses TLS by default. If nothing in front of Fanout -terminates TLS — a local instance, or one on a private network — the exporter -needs `tls: { insecure: true }` under `otlp/fanout`, or it will fail to -connect. **Connect telemetry** in the application generates this block with +The scheme and the port both earn their place. `https://` puts the exporter on +TLS and keeps it there, whatever `tls.insecure` says below it. The port is not +optional: the gRPC exporter validates its endpoint before dialling and refuses +to start without one, with `address fanout.example.com: missing port in +address`. gRPC's own default of 443 belongs to a resolver path this exporter +never reaches. + +If nothing in front of Fanout terminates TLS — a local instance, or one on a +private network — the endpoint is `http://fanout.example.com:7520` and the +exporter needs `tls: { insecure: true }` under `otlp/fanout`, or it will fail +to connect. **Connect telemetry** in the application generates this block with your own endpoint already in it, and includes that line when it applies. A Collector is optional. Fanout speaks the same protocol your SDKs already