Skip to content

Mitigate

Ask once, get every viable option. The tool checks what's deployed in the active env (Receiver? Retriever? GitOps wiring? Which forwarder and analyzer?) and renders a menu of mitigation paths with the unavailable ones dimmed, so you never pick a path that needs infrastructure you don't have.

Each option emits a structured next-action so the agent can route on your choice in one hop.

The four options:

Option What it does How to apply
Drop at the analyzer Vendor-native exclusion (Datadog / Splunk / CloudWatch / Elasticsearch). Pattern is dropped at ingest. Paste the per-option config_snippet into your analyzer.
Drop at the forwarder Forwarder-side filter (fluent-bit, fluentd, otel-collector, etc.). Pattern is dropped before it leaves the host. Paste the per-option config_snippet into your forwarder config.
Cap at the Receiver Per-container byte cap via the rate regulator. PR against the gitops repo. Engine PR
Compact at the Receiver Lossless volume reduction via Compact mode on Splunk (up to 256 KB per event) and self-hosted Elasticsearch, the destinations whose expander reads the compact form back. PR against the gitops repo. Engine PR

Dependency check is listed as a required pre-action for any drop-style option, so the safety gate stays enforced.

Example

You

options for Payment_Gateway_Timeout, it's $58/mo

Log10x

Receiver deployed (gitops: acme/log10x-config). Forwarder: fluentbit. Analyzer: Datadog.

  1. Drop at Datadog: @tenx_hash:"sZw4qq3MCWE" exclusion filter. Stops appearing in Logs Explorer. Run Dependency check first.
  2. Drop at fluent-bit: drop rule on the forwarder; pattern never reaches Datadog. Run Dependency check first.
  3. Cap at the Receiver: per-container byte cap with PR against acme/log10x-config. Pattern is sampled at the severity floor when it goes hot.
  4. Compact at the Receiver: losslessly compact the pattern's container (Splunk, self-hosted Elasticsearch) with full retriever expansion.

Which?

More to ask

  • "options for HealthCheck_Pass, just the cheapest"
  • "only mute/compact options, skip the analyzer drops"

Prerequisites

None. The tool degrades gracefully.

Without a snapshot, it still renders the menu but dims PR-based options when no gitops.repo is set on the active env. With a snapshot, the dim/highlight is based on what's actually deployed.

Schema and samples

Input example

Real call against the demo env (captured by scripts/capture-tool-envelopes.mjs).

{
  "pattern": "cart_cartstore_ValkeyCartStore",
  "view": "summary"
}
Input schema

Agent-facing JSON Schema (the canonical shape the MCP server publishes via tools/list):

{
  "type": "object",
  "properties": {
    "pattern": {
      "type": "string",
      "minLength": 1,
      "description": "The pattern identity to mitigate. Pass the canonical name from a prior log10x_top_patterns / log10x_cost_drivers / log10x_event_lookup row."
    },
    "service": {
      "type": "string",
      "description": "Optional service scope. When set, options that target a single service (forwarder drop, exclusion filter) are scoped to it."
    },
    "snapshot_id": {
      "type": "string",
      "description": "Snapshot from log10x_discover_env. Used to detect which 10x components are deployed in the active env (receiver, retriever, GitOps wiring). When passed, the envelope's `recommendation_audit.capability_sources` reflects which capabilities came from the snapshot vs envs.json. Without it, the tool still works but may dim PR-based options if the active env's envs.json does not list a gitops repo."
    }
  },
  "required": [
    "pattern"
  ],
  "additionalProperties": false
}

Source: src/tools/pattern-mitigate.ts.

Output example

Real envelope from the demo env. view: "summary" returns the full StructuredOutput with typed data. Long arrays + base64 PNG bodies trimmed for readability; the real call returns them in full.

Headline (the 1-line agent-facing answer):

cart\_cartstore\_ValkeyCartStore: 1 of 4 mitigation options enabled (drop_at_analyzer)

{
  "schema_version": "1.0",
  "schema_epoch": "2026-05-25",
  "tool": "log10x_pattern_mitigate",
  "generated_at": "2026-05-26T15:38:35.771Z",
  "view": "summary",
  "summary": {
    "headline": "`cart_cartstore_ValkeyCartStore`: 1 of 4 mitigation options enabled (drop_at_analyzer)"
  },
  "data": {
    "pattern": "cart_cartstore_ValkeyCartStore",
    "options": [
      {
        "id": "drop_at_analyzer",
        "enabled": true,
        "label": "Drop at Splunk"
      },
      {
        "id": "drop_at_forwarder",
        "enabled": false,
        "disabled_reason": "forwarder not detected from env / snapshot",
        "label": "Drop at forwarder"
      },
      {
        "id": "mute_at_10x",
        "enabled": false,
        "disabled_reason": "To enable mute/compact at the 10x engine, set `gitops.repo` (owner/name) in your `~/.log10x/envs.json` entry, or export `LOG10X_GH_REPO=<owner/name>`, or pass a `snapshot_id` from `log10x_discover_env` against a cluster with a receiver pod that has `GH_ENABLED=true` + `GH_REPO=<owner/name>` set.",
        "label": "Mute at 10x receiver"
      },
      "... 1 more elided"
    ],
    "env_capabilities": {
      "can_mute": false,
      "can_compact": false,
      "has_retriever_archive": false,
      "analyzer_vendor": "splunk"
    }
  },
  "actions": [],
  "truncated": false,
  "warnings": []
}
Output schema

The data block inside the StructuredOutput envelope:

interface ToolData {
  pattern: string;
  options: Array<{
    id: string;
    enabled: boolean;
    label: string;
  }>;
  env_capabilities: { can_mute: boolean; can_compact: boolean; has_retriever_archive: boolean; analyzer_vendor: string };
}

Envelope-level fields the agent should also read: summary.headline (1-line answer), actions[] (next-call chain hints as {tool, args, reason}), truncated: boolean, images[] (PNG attachments where applicable), schema_epoch (engine-ID stability boundary).

Next: Retrieve