Skip to content

General

Overview

What is 10x

Turns log events into typed, class-based objects, not raw text. On the OpenTelemetry demo capture that removed 64% of captured bytes losslessly, measured with the other 14 public datasets. Storage and analytics cost reduction is modeled per stack. A stream processor that classifies and optimizes the data an environment already produces.

A lightweight, portable data engine that runs where your data is, locally, at the edge, or in the cloud. Works with your existing infrastructure, log forwarders (Fluent Bit, Fluentd, OTel Collector), log analyzers (Splunk, Datadog, Elastic), and storage (S3, Azure Blobs).

What does 10x do

Names every log event your environment produces from a symbol library compiled from code and, at runtime, classifies and optimizes them without regex or manual rules.

Apps, each tackling a different part of the cost problem:

  • MCP: agent-facing control plane. Drives the other apps from a chat session: query top patterns and cost drivers, sample events from the log analyzer, cap noisy types, pull historical events from S3 on-demand.
  • Reporter (DaemonSet alongside your forwarder): shows which log event types cost the most, pre-ingestion.
  • Receiver (sidecar) with two modes: Filter (lossy, cap noisy event types during spikes) or Compact (lossless in-place shrink where the destination supports it, on Splunk (up to 256 KB per event) or self-hosted Elasticsearch/OpenSearch, via an analyzer-side expand plugin; a no-op on managed destinations like Datadog or CloudWatch).
  • Retriever: offloads selected events to your own S3 bucket and fetches the exact offloaded events back to your analyzer on demand.
Who is 10x for

SRE, DevOps, and FinOps teams facing:

Where does 10x run

Inside your own infrastructure, k8s, EC2, Lambda, or a local workstation. Log data never leaves your environment.

  • Reporter: DaemonSet alongside your forwarder for pre-ingestion cost visibility. Logs never pass through it.
  • Receiver: sidecar alongside your forwarder for Filter (cap noisy events) or Compact (lossless shrink) execution.
  • Retriever: k8s pods that index events offloaded to your own S3 bucket and fetch selected events back to log analyzers on demand.
  • MCP: agent-facing control plane; runs wherever you run an MCP server (workstation, CI, infrastructure).
  • 10x MCP: install it in your AI client and ask for a cost POC. The engine runs on your own machine, so the logs never leave your network. Free, no account needed.
What makes 10x different

Predictable pricing : Commercial tools price per GB ingested, so costs spike with traffic. 10x is priced per node: every host whose logs 10x handles. Volume spikes, new applications, and traffic surges have no impact on cost.

No parsing rules : Pipeline tools need regex or hand-written rules for every log format, and those rules break when code changes and take dedicated engineering to keep current. 10x recognizes your log structure on its own, so there are no per-format rules to write and no regex to maintain; when developers ship new code, the compiler run on that code updates the library, and a recompiled library can rename patterns.

Optimize everywhere : The hybrid AOT/JIT engine powers automatic log data optimization at every stage of the pipeline. Test locally, report on costs and regulate billing spikes at the edge, losslessly compact before shipping, ingest from S3 on-demand.

BYO stack : Works with your existing log forwarders, analyzers, time-series databases, object storage, and compute (K8s, Lambda, EC2). No migration required.

Zero egress : The engine runs as a lightweight runtime inside your infrastructure. Log data never leaves your environment. No vendor access to your logs required.

Powering agents : Every event exits the 10x Engine as a typed object with direct field access, not raw text to parse. Aggregation condenses millions of events into compact summaries, so AI agents operate on structured data instead of burning tokens on raw log lines, without exposing customer data to external models.

What tools does 10x work with

The 10x Engine fits your existing infrastructure. A modular extension framework supports integration across your stack:

  • Log forwarders: Fluent Bit, Fluentd, Filebeat, Logstash, OTel Collector, Vector (six native), plus Splunk UF and Datadog Agent via a Fluent Bit file-system handoff
  • Log analyzers: Splunk, Datadog, Elastic, CloudWatch
  • Time-series: Prometheus, Datadog, Grafana
  • Object storage: S3, Azure Blobs
  • Compute: K8s, Lambda, EC2, Docker

See Inputs, Outputs, and Compute.

Where should I start

Two paths: a free POC that runs locally on a sample of your logs, or a 20-minute DaemonSet deploy for live log analyzer cost visibility.

  1. Cost POC (free, no account): install the 10x MCP and ask it for a cost POC. It reads a sample from your log analyzer over its API, or from a Kubernetes cluster through kubectl, and runs the engine locally. It reports the top patterns by cost and, per pattern, the events and GB a plan would move; on Datadog and CloudWatch, where compact is a no-op, that is the volume moved to the cheaper tier or your S3.
  2. Reporter: deploy as a DaemonSet alongside your forwarder for pre-ingestion cost visibility. Deploy in 20 minutes.

The Reporter publishes metrics to your time-series backend, where cost dashboards show spend per application, volume by severity, and the top patterns by cost. Act on the findings with the Receiver (Filter or Compact mode) or Retriever.

For agentless analyzer-side analysis without deploying a DaemonSet, the MCP server's SIEM-sample tool offers on-demand log analyzer polling.

Comparisons

Does 10x work with Lambda and serverless

Yes. On AWS Lambda the engine runs as its own Lambda extension inside each function's execution environment: attaching the published tenx-receive layer (x86_64 and arm64) is a layer ARN plus environment variables, and events are regulated before the first byte leaves the function. Per-pattern mutes live in a file in your own S3 bucket that the extension refetches, so a policy change converges with one aws s3 cp, no redeploy.

  • Extension: published layer ARNs per region and architecture, the environment reference, and the script for baking your own layer.
  • Retriever: offloads Lambda log events to your own S3 bucket and fetches selected events back to your analyzer on demand.
  • MCP server: the SIEM-sample tool analyzes Lambda log costs via your log analyzer's API (Datadog, CloudWatch, Splunk). Read-only, agentless, on-demand, no Lambda modification needed.

Serverless functions are not counted as nodes; count the hosts whose logs 10x handles. Retriever pods do not add to the node count.

How does 10x differ from log forwarders (Fluentd, OTel, Fluent Bit)

Complementary. The 10x Reporter deploys as a DaemonSet alongside your forwarder (pattern similar to datadog-agent or otel-collector); the Receiver runs as a sidecar between the forwarder and the analyzer to filter or compact events before they ship.

Log forwarders collect, route, and do basic parsing. 10x adds cost awareness (which event types cost the most), regulation (cap noisy types during spikes), and lossless volume reduction where the destination supports it (Splunk up to 256 KB per event, self-hosted Elasticsearch or OpenSearch). No forwarder replacement needed.

How does 10x differ from Cribl

Cribl is a data pipeline you configure separately for each log source. It cuts volume by dropping log lines or replacing groups of them with rolled-up summaries.

Keeping every line. Cribl lowers what a destination receives by dropping lines, trimming fields or rolling lines into summaries, and it can archive the full stream to object storage, unindexed by default. 10x lowers the bill while keeping every line, and drops or samples only when you choose. For each pattern (one kind of log line, regardless of timestamps and IDs) it picks the cheapest way to keep the line, based on your log analyzer:

  • Compact (shrink the line in place): on Splunk (up to 256 KB per event) and self-hosted Elasticsearch/OpenSearch, 10x shrinks each line to a fraction of its size, and your analyzer still stores it, searches it, and shows the full original.
  • Tier down (move it to a cheaper tier): when your analyzer sells a lower-cost class you can still search, like Datadog Flex, CloudWatch Infrequent Access, or Azure Monitor Basic/Auxiliary Logs, 10x moves the line into it.
  • Offload (park it in storage you own): with any analyzer, 10x sends the line to an S3 or S3-compatible bucket you own, and fetches the exact original back on demand with no restore step; lines loaded back into your log analyzer bill as ingest there. Azure Blob Storage is not an offload target.

Getting data back. Cribl brings archived data back into a destination with Replay, which collects the time range, runs it through a pipeline again and re-ingests it, and the destination meters it as new volume; Cribl Search can scan the archive in place without re-ingesting. 10x indexes offloaded lines as it writes them, so a fetch reads only the matching lines from your own S3, and loading them back into your analyzer is optional.

Setup and upkeep. Cribl needs a reduction pipeline per source, revised whenever a log format changes. 10x needs no per-source pipeline: it decides what to do with each pattern on its own, and you set a budget and approve the plan it proposes.

Pricing. Cribl charges by the volume it processes, so a tool bought to lower the bill costs more as data grows. 10x is a flat fee per node, published, and does not rise with log volume.

How does 10x differ from Grepr

Grepr is a service you send your logs to. It cuts the feed reaching your log analyzer by sampling it and replacing groups of lines with summaries.

Where your logs go. Grepr reduces your logs inside its own cloud, so the content leaves your environment to be processed. 10x reduces logs inside your own infrastructure, so the content never leaves.

Keeping every line. Grepr samples the feed and replaces groups of lines with summaries, keeping the full lines only in its own data lake. 10x keeps every line, and drops or samples only when you choose. For each pattern it picks the cheapest way to keep the line, based on your log analyzer:

  • Compact (shrink the line in place): on Splunk (up to 256 KB per event) and self-hosted Elasticsearch/OpenSearch, 10x shrinks each line to a fraction of its size, and your analyzer still stores, searches, and shows the full original.
  • Tier down (move it to a cheaper tier): a class you can still search, like Datadog Flex, CloudWatch Infrequent Access, or Azure Monitor Basic/Auxiliary Logs.
  • Offload (park it in storage you own): with any analyzer, 10x sends the line to an S3 or S3-compatible bucket you own, and fetches the exact original back on demand with no restore step; lines loaded back into your log analyzer bill as ingest there. Azure Blob Storage is not an offload target.

Getting data back. When you investigate an incident, Grepr copies the relevant full lines back into your log analyzer, which charges you to take in that volume a second time.

Proving the cut. With 10x you set a budget and approve the plan it proposes, and savings are then measured per pattern over time, so they can be checked rather than taken on faith. Grepr auto-tunes inside its own cloud and commits to no number, stating that results depend on how noisy your logs are.

Pricing. Grepr charges for compute plus the volume you send, and publishes no rate card. 10x is a flat fee per node, published, and does not rise with log volume.

How does 10x differ from Tero

Tero is software that sits between your apps and your log analyzers and screens the traffic. You write rules that tell it to drop lines, sample them, rate-limit them, or blank out sensitive fields before they reach those analyzers.

Keeping every line. Tero cuts log volume one way, by deleting lines before they reach your log analyzer, and what it deletes is gone. 10x keeps every line, and drops or samples only when you choose. Per line, only offload takes the line off the log analyzer's bill the way deleting it does; a compact or tiered-down line still bills at its smaller size or cheaper rate. For each pattern 10x picks the cheapest way to keep the line, based on your log analyzer:

  • Compact (shrink the line in place): on Splunk (up to 256 KB per event) and self-hosted Elasticsearch/OpenSearch, 10x shrinks each line to a fraction of its size, and your analyzer still stores, searches, and shows the full original.
  • Tier down (move it to a cheaper tier): a class you can still search, like Datadog Flex, CloudWatch Infrequent Access, or Azure Monitor Basic/Auxiliary Logs.
  • Offload (park it in storage you own): with any analyzer, 10x sends the line to an S3 or S3-compatible bucket you own, and fetches the exact original back on demand with no restore step; lines loaded back into your log analyzer bill as ingest there. Azure Blob Storage is not an offload target.

No way back with Tero. Tero keeps no copy, so nothing it deletes can be recovered.

Setup and upkeep. Tero needs reduction rules per source, revised whenever a log format changes. 10x needs no per-source rules: it decides what to do with each pattern on its own, and you set a budget and approve the plan it proposes.

Pricing. Tero publishes no price; you book an assessment and a sales engineer gives you a number. 10x's price is published and charged per node, based on how many nodes you have, not how much log data you send.

How does 10x differ from log analytics tools (Splunk, Datadog, Elastic)

10x partners with your existing platform to cut the bill, you keep Splunk, Datadog, or Elastic; 10x handles cost reduction through sampling, lossless volume reduction, and S3 offload. Your analyzer configuration, dashboards, queries, and alerts keep working on events that pass through as they are.

  • Reporter: identifies which event types incur the highest costs (pre-ingestion, DaemonSet)
  • Receiver, Filter mode: caps noisy event types before they ship
  • Receiver, Compact mode: losslessly compacts events before ingestion where the destination supports it (Splunk up to 256 KB per event, self-hosted Elasticsearch/OpenSearch)
  • Retriever: offloads selected events to your own S3 bucket and fetches the exact events back to your analyzer on demand

The open-source Log10x App auto-expands compact logs at search time. For other analyzers, Retriever expands and streams events on-demand.

For compact and tiered-down events, what reads them depends on the platform:

  • Splunk: classic dashboards keep their SPL through the app's dashboard hook; the search bar, saved searches and Dashboard Studio panels start with the app's tx command; alerts are compiled once at save time
  • Elasticsearch/OpenSearch: match and match_phrase queries, and the Kibana views built on them, expand through the plugin; term, wildcard, regexp, and query_string queries and aggregations see the compact form
  • Datadog: Flex Logs answer Log Explorer queries; monitors need a Standard index
  • CloudWatch: Infrequent Access log groups answer Logs Insights queries; metric filters, subscription filters, and Live Tail need a Standard group
  • Azure Monitor: Basic and Auxiliary tables answer KQL queries and workbooks; Azure Monitor dashboards need the Analytics plan, Basic tables take simple log alerts only, and Auxiliary tables take no alerts
How does 10x differ from APMs and OpenTelemetry

Different goals. APMs (Dynatrace, AppDynamics) and OTel add instrumentation to your applications, more logging, more profiling, more tracing data. 10x processes the data your environment already produces to reduce its cost.

10x needs no SDK and no bytecode injection, so your application code runs exactly as written. 10x processes the output downstream via the DaemonSet Reporter or sidecar Receiver alongside your log forwarder.

The two are complementary: use APMs and OTel for application insights, then use 10x to reduce the cost of storing and analyzing that telemetry.

How do I extend 10x with custom integrations

Build custom input/output integrations using the 10x API framework:

Integration Type API Description
Log forwarders InputStream or Log4j2 Read from or write to custom log forwarding tools
Log analyzers Apache Camel Read from 400+ analytics sources via YAML routes
Object storage Object Storage Index and query from GCP Storage, MinIO, etc.
Receiver modules JavaScript Define custom regulation rules and filters
Launcher types Launcher Deploy in k8s, Quarkus, or CLI