Skip to content

FAQ

The Edge Reporter identifies storage and licensing cost drivers by analyzing app/infra events before forwarders ship them to log analyzers.

Overview

What is Edge Reporter and what metrics does it provide

Edge Reporter is a read-only agent that sits alongside your log forwarder -- it monitors the live event stream without modifying, filtering, or redirecting any data. It provides real-time metrics including:

Unlike cloud-based analysis, Edge Reporter captures pre-transport metrics. You see exactly what you're sending and what it will cost before data reaches your destination.

Does Edge Reporter reduce my costs directly

Reporter provides visibility -- it shows where every dollar goes by classifying events using pre-compiled log templates from your source code.

To reduce costs, pair Reporter with:

Start with Dev to preview savings locally, then deploy Cloud Reporter for agentless cost analysis via your SIEM's API. Edge Reporter adds pre-transport visibility once you move to edge deployment.

What visibility does Edge Reporter provide vs. my SIEM's built-in metrics

SIEM-side metrics show what arrived at your platform but lack granular per-event-type attribution and pre-transport context.

Edge Reporter captures metrics at the origin and automatically enriches every event -- no manual regex or configuration required:

  • Message extraction -- identifies the core message pattern from each event for cost-per-event-type metrics
  • Kubernetes context -- container, pod, and namespace for per-workload cost attribution
  • Severity level -- classifies by level (DEBUG, INFO, WARN, ERROR) to surface excessive debug logging
  • Multi-line grouping -- groups stack traces as single logical events for accurate costing
  • HTTP codes and GeoIP enrichment from log content

This surfaces optimization opportunities not available from the SIEM side -- like which specific services, event types, or severity levels drive costs. Use the Console to explore breakdowns interactively.

Integration & Deployment

Which log forwarders does Edge Reporter support

Edge Reporter integrates with all major log forwarders:

Deployment: Runs as a sidecar alongside your forwarder. Kubernetes deployment via Helm chart (DaemonSet). Setup time: ~20 minutes.

Reporter is read-only -- events pass through unchanged. Integration typically requires adding a few lines to your forwarder config.

Resource requirements: Same engine as Edge Optimizer and Regulator — 512 MB heap + 2 threads handles 100+ GB/day per node. Reporter is async and never in the data path, so it adds zero latency to log shipping. See Performance FAQ for sizing details.

Where do the metrics go

Edge Reporter exports metrics to any supported time-series database:

  • Prometheus (scrape endpoint or remote write)
  • Datadog
  • CloudWatch
  • Elastic
  • SignalFx

Metrics include volume by message pattern, event counts, and cost estimates. Build dashboards in your existing tools, set alerts on cost thresholds, and correlate log costs with application metrics.

All metric destinations can be configured simultaneously. The system is extensible — define custom registries to add support for additional time-series systems.

What latency does Edge Reporter add

Edge Reporter runs as an async sidecar -- it observes the log stream but is never in the data path. Metrics calculation runs in parallel with forwarding. If Reporter stops, logs continue flowing to their destination unchanged.

Use Cases

Can I use Edge Reporter without other Log10x products

Yes, Edge Reporter is standalone. It can be used independently to understand log cost distribution without other Log10x components.

The metrics are valuable on their own for:

  • Capacity planning and trend analysis
  • Budget forecasting with real volume data
  • Chargeback allocation across teams
  • Anomaly detection on volume spikes

All metrics feed into ROI Analytics -- Grafana dashboards showing cost per application, volume by severity, and top patterns by cost. Optional: enable AI-powered analysis for ranked optimization recommendations based on your metrics.

Can Edge Reporter identify repeated stack traces as cost drivers

Yes. Exception stack traces spanning 50-100 lines repeated thousands of times are a common cost driver.

Edge Reporter measures stack trace volume at the forwarder level -- before data reaches your SIEM -- and quantifies the savings potential:

  • Original: 80-line trace x 10,000 occurrences = 800,000 lines
  • After Edge Optimizer compaction: 80-line template + 10,000 references = ~80,100 lines
  • Projected reduction: 90%+ for repeated stack traces

Works with all languages: Python tracebacks, Java/Kotlin, Node.js, Go panic dumps, Ruby, C# .NET, PHP. Deploy Edge Regulator to act on the findings.

Next: Edge Regulator