Services

Rank every tracked service by cost when you need to know which services are driving the bill. Returns a ranked list with per-service volume, dollar share of total, and a Top-N = X% of volume coverage line so you can tell whether a drill-down on the top few captures the question.

Example

You

rank services by cost, 7d

Log10x

4 services account for 80% of $60K/wk: payments-svc $24K · cart-svc $18K · checkout-svc $11K · ad-svc $7K. 11 more below 5%. Top 3 services = 88% of volume.

More to ask

• "top services by volume, 30d"
• "services we're monitoring"
• "services in staging env, last hour"

Prerequisites

This tool requires the Reporter deployed.

Schema and samples

Input example

Real call against the demo env (captured by scripts/capture-tool-envelopes.mjs).

{
  "limit": 5,
  "timeRange": "7d",
  "view": "summary"
}

Input schema

Agent-facing JSON Schema (the canonical shape the MCP server publishes via tools/list):

{
  "type": "object",
  "properties": {
    "timeRange": {
      "type": "string",
      "enum": [
        "15m",
        "1h",
        "6h",
        "24h",
        "1d",
        "7d",
        "30d"
      ],
      "default": "7d",
      "description": "Time range. Sub-day values available for incident-window service ranking. '24h' and '1d' are equivalent."
    },
    "analyzerCost": {
      "type": "number",
      "description": "SIEM ingestion cost in $/GB"
    },
    "environment": {
      "type": "string",
      "description": "Environment nickname"
    },
    "exception_services": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "maxItems": 50,
      "description": "Customer-flagged services that must stay in the SIEM with full retention (audit / regulatory / executive). Per row, marks current_mode=\"pass\" and points next_action at pattern_mitigate instead of the configure_engine bulk path."
    },
    "view": {
      "type": "string",
      "const": "summary",
      "default": "summary",
      "description": "Output format. Always \"summary\" — the typed envelope (data.services[], data.totals). Field retained for backward-compat."
    }
  },
  "additionalProperties": false
}

Source: src/tools/services.ts.

Output example

Real envelope from the demo env. view: "summary" returns the full StructuredOutput with typed data. Long arrays + base64 PNG bodies trimmed for readability; the real call returns them in full.

Headline (the 1-line agent-facing answer):

28 services over this week: opentelemetry-collector leads at $50/wk (72% of total $69/wk).

{
  "schema_version": "1.0",
  "schema_epoch": "2026-05-25",
  "tool": "log10x_services",
  "generated_at": "2026-05-26T15:37:07.804Z",
  "view": "summary",
  "summary": {
    "headline": "28 services over this week: opentelemetry-collector leads at $50/wk (72% of total $69/wk)."
  },
  "data": {
    "time_range": "this week",
    "cost_per_gb": 1.5,
    "period": "/wk",
    "total_bytes": 49585873423.42819,
    "total_cost": 69.27066495189656,
    "service_count": 28,
    "top_n_share_pct": 88,
    "services": [
      {
        "rank": 1,
        "name": "opentelemetry-collector",
        "bytes": 35829123334.79456,
        "cost": 50.05270708556459,
        "pct": 72.2567151915209
      },
      {
        "rank": 2,
        "name": "payment",
        "bytes": 6550557827.022675,
        "cost": 9.151023570945497,
        "pct": 13.210532304403626
      },
      {
        "rank": 3,
        "name": "cart",
        "bytes": 1495589805.8115377,
        "cost": 2.0893148227755973,
        "pct": 3.016161060712315
      },
      "... 25 more elided"
    ]
  },
  "actions": [
    {
      "tool": "log10x_top_patterns",
      "args": {
        "service": "opentelemetry-collector"
      },
      "reason": "current top patterns for the highest-cost service"
    },
    {
      "tool": "log10x_investigate",
      "args": {
        "starting_point": "opentelemetry-collector"
      },
      "reason": "causal-chain analysis on the top service"
    }
  ],
  "truncated": false,
  "warnings": []
}

Output schema

The data block inside the StructuredOutput envelope:

interface ToolData {
  time_range: string;
  cost_per_gb: number;
  period: string;
  total_bytes: number;
  total_cost: number;
  service_count: number;
  top_n_share_pct: number;
  services: Array<{
    rank: number;
    name: string;
    bytes: number;
    cost: number;
    pct: number;
  }>;
}

Envelope-level fields the agent should also read: summary.headline (1-line answer), actions[] (next-call chain hints as {tool, args, reason}), truncated: boolean, images[] (PNG attachments where applicable), schema_epoch (engine-ID stability boundary).

Next: Savings