Deploy
Deploy the Regulator app to Kubernetes via Helm.
The chart deploys your forwarder with the 10x Engine as a sidecar process. Most forwarders run as a DaemonSet, while Logstash runs as a StatefulSet.
Step 1: Prerequisites
| Requirement | Description |
|---|---|
| Log10x License | Your license key (get one) |
| Helm | Helm CLI installed |
| kubectl | Configured to access your cluster |
| GitHub Token | Personal access token for config repo (create one) |
| Output Destination | Elasticsearch, Splunk, or other log backend configured |
Step 2: Add Helm Repository
For Kubernetes, use the Fluent Bit tab — Splunk Connect for Kubernetes is Fluent Bit-based. For VM infrastructure, see the Splunk UF regulator guide.
For Kubernetes, use the Fluent Bit or OTel Collector tab. For VM infrastructure, see the Datadog Agent regulator guide.
View all chart values:
For Kubernetes, use the Fluent Bit tab — Splunk Connect for Kubernetes is Fluent Bit-based. For VM infrastructure, see the Splunk UF regulator guide.
For Kubernetes, use the Fluent Bit or OTel Collector tab. For VM infrastructure, see the Datadog Agent regulator guide.
Step 3: Configure Deployment Settings
Create a new file called my-regulator.yaml in your working directory. This Helm values file will be used in all subsequent steps.
All 10x values are nested under the tenx block. Charts retain all original values from official Fluentd, Fluent Bit, and Filebeat charts.
For Kubernetes, use the Fluent Bit tab — Splunk Connect for Kubernetes is Fluent Bit-based. For VM infrastructure, see the Splunk UF regulator guide.
For Kubernetes, use the Fluent Bit or OTel Collector tab. For VM infrastructure, see the Datadog Agent regulator guide.
Step 4: Load Configuration
Load the 10x Engine config folder into the cluster using one of the methods below.
If you skip this step, the default configuration bundled with the Log10x image is used.
An init container clones your configuration repository before each pod starts. Works with GitHub, GitLab, Bitbucket, or any HTTPS-accessible Git provider.
- Fork the Config Repository
- Create a branch for your configuration changes
- Edit the app configuration to match your metric output and enrichment options
Add to your Helm values:
tenx:
config:
git:
enabled: true
url: "https://github.com/YOUR-ACCOUNT/config.git"
branch: "my-regulator-config" # Optional
# symbols: # Uncomment if using symbol library
# git:
# enabled: true
# url: "https://github.com/YOUR-ACCOUNT/symbols.git"
gitToken: "YOUR-GIT-TOKEN"
For production, store the token in a Kubernetes Secret rather than in the values file.
Mount an existing PersistentVolumeClaim that contains your configuration directory. This approach works in air-gapped environments and requires no external network access.
- Create a PVC containing your configuration files (cloned from the Config Repository)
- Reference it in your Helm values:
Step 5: Configure Secrets
Store sensitive credentials in Kubernetes Secrets. Only add secrets for metric outputs you've configured.
Create the secret:
kubectl create secret generic regulator-credentials \
--from-literal=elasticsearch-username=elastic \
--from-literal=elasticsearch-password=YOUR_ES_PASSWORD \
--from-literal=datadog-api-key=YOUR_DATADOG_API_KEY
Note: Only include credentials for outputs you've configured.
Add secret references to your my-regulator.yaml:
env:
# For Datadog metrics
- name: DD_API_KEY
valueFrom:
secretKeyRef:
name: regulator-credentials
key: datadog-api-key
# For Elasticsearch metrics
# - name: ELASTIC_API_KEY
# valueFrom:
# secretKeyRef:
# name: regulator-credentials
# key: elastic-api-key
# For AWS CloudWatch metrics
# - name: AWS_ACCESS_KEY_ID
# valueFrom:
# secretKeyRef:
# name: regulator-credentials
# key: aws-access-key-id
# For SignalFx metrics
# - name: SIGNALFX_ACCESS_TOKEN
# valueFrom:
# secretKeyRef:
# name: regulator-credentials
# key: signalfx-access-token
daemonset:
extraEnvs:
# For Elasticsearch output
- name: ELASTICSEARCH_USERNAME
valueFrom:
secretKeyRef:
name: regulator-credentials
key: elasticsearch-username
- name: ELASTICSEARCH_PASSWORD
valueFrom:
secretKeyRef:
name: regulator-credentials
key: elasticsearch-password
# For Datadog metrics (optional)
# - name: DD_API_KEY
# valueFrom:
# secretKeyRef:
# name: regulator-credentials
# key: datadog-api-key
For Kubernetes, use the Fluent Bit tab — Splunk Connect for Kubernetes is Fluent Bit-based. For VM infrastructure, see the Splunk UF regulator guide.
For Kubernetes, use the Fluent Bit or OTel Collector tab. For VM infrastructure, see the Datadog Agent regulator guide.
Step 6: Forwarder
Configure your forwarder for log collection and output destinations. The Log10x regulator filters events before they reach your final destination.
Configure your output destination. The chart automatically routes events through the regulator.
Note: The Log10x chart automatically configures event routing through the regulator.
daemonset:
filebeatConfig:
filebeat.yml: |
filebeat.inputs:
- type: filestream
id: tenx_internal
paths:
- /var/log/tenx/*.log
fields:
log_type: tenx_internal
- type: container
paths:
- /var/log/containers/*.log
processors:
- add_kubernetes_metadata:
host: ${NODE_NAME}
matchers:
- logs_path:
logs_path: "/var/log/containers/"
output.elasticsearch:
hosts: '["https://elasticsearch-master:9200"]'
username: '${ELASTICSEARCH_USERNAME}'
password: '${ELASTICSEARCH_PASSWORD}'
indices:
- index: "tenx_internal"
when.equals:
fields.log_type: "tenx_internal"
- index: "logs-filtered-%{+yyyy.MM.dd}"
mode: "daemonset"
config:
receivers:
filelog:
include: [/var/log/pods/*/*/*.log]
operators:
- type: container
id: container-parser
exporters:
elasticsearch:
endpoints: ["https://elasticsearch-master:9200"]
logs_index: logs-filtered
service:
pipelines:
logs:
receivers: [filelog]
processors: [memory_limiter, batch]
exporters: [elasticsearch]
Note: The Log10x chart automatically configures sidecar communication for filtering.
logstashPipeline:
logstash.conf: |
input {
beats {
port => 5044
}
}
output {
elasticsearch {
hosts => ["elasticsearch-master:9200"]
index => "logs-filtered-%{+YYYY.MM.dd}"
}
}
Note: The Log10x chart automatically configures sidecar communication for filtering.
For Kubernetes, use the Fluent Bit tab — Splunk Connect for Kubernetes is Fluent Bit-based. For VM infrastructure, see the Splunk UF regulator guide.
For Kubernetes, use the Fluent Bit or OTel Collector tab. For VM infrastructure, see the Datadog Agent regulator guide.
Step 7: Deploy
Create your namespace (if needed) and deploy:
For Kubernetes, use the Fluent Bit tab — Splunk Connect for Kubernetes is Fluent Bit-based. For VM infrastructure, see the Splunk UF regulator guide.
For Kubernetes, use the Fluent Bit or OTel Collector tab. For VM infrastructure, see the Datadog Agent regulator guide.
Step 8: Verify
Verify the install in three phases: pods Ready → 10x processor alive → regulated events flowing. A probe passes when its commands exit 0.
Phase A — pods Ready
The selector depends on the forwarder chart family. log10x-fluent/* and log10x-otel/* charts use the k8s-recommended label set; log10x-elastic/* charts use legacy Helm labels.
Phase B — 10x regulator plugin alive
Look for regulator initialization lines in the forwarder container (10x runs inside the forwarder image — no separate sidecar for any log10x-repackaged chart).
Phase C — regulated events flowing
Confirm the forwarder is actually writing regulated events to its destination. For a real destination, check the destination's UI (Elasticsearch index, Splunk sourcetype, Datadog logs view). For mock/stdout output, grep for the TENX-MOCK marker:
View mute/sample counts in the dashboard:
Once running, view your mute/sample activity in the Regulator Dashboard.
Step 9: Teardown
Uninstall the Helm release:
Clean up derived resources (use the chart family's label convention):
Verify nothing remains:
Delete the namespace (optional):
Quickstart Full Sample
tenx:
enabled: true
apiKey: "YOUR-LICENSE-KEY-HERE"
kind: "regulate"
runtimeName: "my-regulator-filebeat"
github:
config:
enabled: true
token: "YOUR-GITHUB-TOKEN"
repo: "YOUR-ACCOUNT/REPO-NAME"
daemonset:
filebeatConfig:
filebeat.yml: |
filebeat.inputs:
- type: filestream
id: tenx_internal
paths:
- /var/log/tenx/*.log
fields:
log_type: tenx_internal
- type: container
paths:
- /var/log/containers/*.log
processors:
- add_kubernetes_metadata:
host: ${NODE_NAME}
matchers:
- logs_path:
logs_path: "/var/log/containers/"
output.elasticsearch:
hosts: '["https://elasticsearch-master:9200"]'
indices:
- index: "tenx_internal"
when.equals:
fields.log_type: "tenx_internal"
- index: "logs-filtered-%{+yyyy.MM.dd}"
mode: "daemonset"
tenx:
enabled: true
apiKey: "YOUR-LICENSE-KEY-HERE"
kind: "regulate"
runtimeName: "my-otel-regulator"
github:
config:
enabled: true
token: "YOUR-GITHUB-TOKEN"
repo: "YOUR-ACCOUNT/REPO-NAME"
config:
exporters:
elasticsearch:
endpoints: ["https://elasticsearch-master:9200"]
logs_index: logs-filtered
service:
pipelines:
logs:
receivers: [filelog]
processors: [memory_limiter, batch]
exporters: [elasticsearch]
tenx:
enabled: true
apiKey: "YOUR-LICENSE-KEY-HERE"
kind: "regulate"
runtimeName: "my-logstash-regulator"
github:
config:
enabled: true
token: "YOUR-GITHUB-TOKEN"
repo: "YOUR-ACCOUNT/REPO-NAME"
# Logstash pipeline for final destination
logstashPipeline:
output.conf: |
output {
elasticsearch {
hosts => ["elasticsearch-master:9200"]
index => "logs-filtered"
}
}
For Kubernetes, use the Fluent Bit tab — Splunk Connect for Kubernetes is Fluent Bit-based. For VM infrastructure, see the Splunk UF regulator guide.
For Kubernetes, use the Fluent Bit or OTel Collector tab. For VM infrastructure, see the Datadog Agent regulator guide.
Datadog Output Examples
To send filtered events to Datadog, use the file relay pattern: Fluent Bit writes regulated events to a folder that the Datadog Agent monitors. This keeps the Datadog Agent as the forwarder (handling buffering, retries, metadata enrichment) while 10x regulates events inline.
tenx:
enabled: true
apiKey: "YOUR-LICENSE-KEY-HERE"
kind: "regulate"
runtimeName: "my-fluentbit-regulator"
config:
outputs: |
[OUTPUT]
Name file
Match *
Path /var/log/regulated
Format plain
Then configure the Datadog Agent to monitor the regulated output folder:
logs:
- type: file
path: /var/log/regulated/*.log
service: myapp
source: myapp
On EKS, mount a shared emptyDir volume between the Fluent Bit + 10x pod and the Datadog Agent DaemonSet at /var/log/regulated.
mode: "daemonset"
tenx:
enabled: true
apiKey: "YOUR-LICENSE-KEY-HERE"
kind: "regulate"
runtimeName: "my-otel-regulator"
config:
exporters:
datadog:
api:
key: "${env:DD_API_KEY}"
site: datadoghq.com
service:
pipelines:
logs:
receivers: [filelog]
processors: [memory_limiter, batch]
exporters: [datadog]
Splunk HEC Output Examples
To send filtered events to Splunk instead of Elasticsearch, use Splunk HEC output.
tenx:
enabled: true
apiKey: "YOUR-LICENSE-KEY-HERE"
kind: "regulate"
runtimeName: "my-fluentd-regulator"
outputConfigs:
06_final_output.conf: |-
<label @FINAL-OUTPUT>
<match **>
@type splunk_hec
hec_host "splunk-hec.example.com"
hec_port 8088
hec_token "YOUR-HEC-TOKEN"
index main
source kubernetes
</match>
</label>
mode: "daemonset"
tenx:
enabled: true
apiKey: "YOUR-LICENSE-KEY-HERE"
kind: "regulate"
runtimeName: "my-otel-regulator"
config:
exporters:
splunk_hec:
endpoint: "https://splunk-hec.example.com:8088/services/collector"
token: "YOUR-HEC-TOKEN"
index: main
tls:
insecure_skip_verify: true
service:
pipelines:
logs:
receivers: [filelog]
processors: [memory_limiter, batch]
exporters: [splunk_hec]
tenx:
enabled: true
apiKey: "YOUR-LICENSE-KEY-HERE"
kind: "regulate"
runtimeName: "my-logstash-regulator"
logstashPipeline:
output.conf: |
output {
http {
url => "https://splunk-hec.example.com:8088/services/collector"
http_method => "post"
headers => ["Authorization", "Splunk YOUR-HEC-TOKEN"]
format => "json"
}
}