---
title: Prometheus Source
description: >-
  Learn how to collect metrics pushed by Prometheus clients using the
  Observability Pipelines Worker.
breadcrumbs: Docs > Observability Pipelines > Sources > Prometheus Source
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Prometheus Source
Available for:
{% icon name="icon-metrics" /%}
 Metrics 
## Overview{% #overview %}

Use Observability Pipelines' Prometheus source to receive metrics pushed by your Prometheus clients.

## Setup{% #setup %}

{% alert level="danger" %}
For Secrets Management: Only enter the identifiers for the Prometheus address and, if applicable, the username and password for plain (also known as basic) authorization. Do not enter the actual values.
{% /alert %}

Set up this source when you [set up a pipeline](https://docs.datadoghq.com/observability_pipelines/configuration/set_up_pipelines.md). You can set up a pipeline in the [UI](https://app.datadoghq.com/observability-pipelines), using the [API](https://docs.datadoghq.com/api/latest/observability-pipelines.md), or with [Terraform](https://registry.terraform.io/providers/datadog/datadog/latest/docs/resources/observability_pipeline). The instructions in this section are for setting up the source in the UI.

After you select the Prometheus source in the pipeline UI:

1. Enter the identifier for your Prometheus address. An example of the socket address that the identifier references: `0.0.0.0:9091`. If you leave the identifier field blank, the default is used.
1. Enter the URL path on which metric POST requests are accepted, such as `/api/v1/write`.
1. Select your authorization strategy. If you selected Plain:
   - Enter the identifiers for your Prometheus username and password. If you leave them blank, the defaults are used.

{% alert level="info" %}
If you enter secret identifiers and then choose to use environment variables, the environment variable is the identifier entered and prepended with `DD_OP_`. For example, if you entered `PASSWORD_1` for a password identifier, the environment variable for that password is `DD_OP_PASSWORD_1`.
{% /alert %}

### Optional settings{% #optional-settings %}

#### Configure authentication tokens{% #configure-authentication-tokens %}

If you store tokens as credentials in your Prometheus client's authorization header, you can configure the Worker to check if incoming requests have a valid token. Request events that do not have a valid token are dropped. The Worker can also look up an endpoint path or an IP address instead of a header. You can only set authentication tokens when the authorization strategy is set to **None**.

To configure authentication tokens, enable the **Configure authentication tokens** toggle:

1. Click **Manage Tokens** and then **Add Token**.
1. Enter the identifier for your token key.**Note**: If you are using environment variables, the environment variable for this token is the identifier you entered prepended with `DD_OP_`.
1. (Optional) Enter a field and value if you want to add additional information to logs that are successfully authenticated with this specific token.
1. Select the path to the token in the **Path to Token** dropdown menu:
   - **Header** for a custom header or an authorization header, such as `"Authorization: Basic ABCDEF1234567="`.
     - Optionally, enter the header name. **Note**: The header name is case insensitive.
   - **Address** for an IP address.
   - **Path** for an endpoint path.

#### Configure keepalive{% #configure-keepalive %}

To configure keepalive settings for connections to the source, enable the Configure keepalive toggle:

- Max connection age: The maximum number of seconds after which a connection is closed. The default is `300` seconds.
- Max connection age jitter factor: The factor used to randomize the max connection age, so connections don't all close simultaneously. The default is `0.1`.

#### Enable TLS{% #enable-tls %}

Toggle the switch to **Enable TLS**.

- If you are using Secrets Management, enter the identifier for the key pass. See Secret defaults for the default used if the field is left blank.
- Enter the following certificate and key files:
  - `Server Certificate Path`: The path to the certificate file that has been signed by your Certificate Authority (CA) root file in DER, PEM, or CRT (X.509).
  - (Optional) `CA Certificate Path`: The path to the certificate file that is your Certificate Authority (CA) root file in DER, PEM, or CRT (X.509).
  - (Optional) `Private Key Path`: The path to the `.key` private key file that belongs to your Server Certificate Path in DER, PEM, or CRT (PKCS #8) format.
  - **Notes**:
    - The configuration data directory `/var/lib/observability-pipelines-worker/config/` is automatically appended to the file paths. See [Advanced Worker Configurations](https://docs.datadoghq.com/observability_pipelines/configuration/install_the_worker/advanced_worker_configurations.md) for more information.
    - The file must be readable by the `observability-pipelines-worker` group and user.

- (Optional) Toggle **Verify certificate** to require connecting clients to present a valid client certificate. This enforces mutual TLS (mTLS), where the Worker verifies the identity of each connecting client.

## Secret defaults{% #secret-defaults %}

These are the defaults used for secret identifiers and environment variables.

{% tab title="Secrets Management" %}

- Prometheus address identifier:
  - References the socket address on which the Observability Pipelines Worker listens for Prometheus metrics. An example of the socket address that the identifier references: `0.0.0.0:9091`.
  - The default identifier is `SOURCE_PROMETHEUS_REMOTE_WRITE_ADDRESS`.
- If you are using plain authentication:
  - Prometheus username identifier:
    - The default identifier is `SOURCE_PROMETHEUS_REMOTE_WRITE_USERNAME`.
  - Prometheus password identifier:
    - The default identifier is `SOURCE_PROMETHEUS_REMOTE_WRITE_PASSWORD`.

{% /tab %}

{% tab title="Environment Variables" %}

- Prometheus address:
  - The Observability Pipelines Worker listens on this socket address, such as `0.0.0.0:9091`, for metrics pushed by your Prometheus clients.
  - The default environment variable is `DD_OP_SOURCE_PROMETHEUS_REMOTE_WRITE_ADDRESS`.
- If you are using plain authentication:
  - Prometheus endpoint authentication username:
    - The default environment variable is `DD_OP_SOURCE_PROMETHEUS_REMOTE_WRITE_USERNAME`.
  - Prometheus endpoint authentication password:
    - The default environment variable is `DD_OP_SOURCE_PROMETHEUS_REMOTE_WRITE_PASSWORD`.

{% /tab %}