Node Counting
CPU/memory per node, and how to count nodes across aggregators, Retriever-only, MCP-only, analytics hosts, Lambda, and partial-rollout setups.
What are the CPU and memory requirements per node
You control both. The 10x Engine runs on the JVM (HotSpot or GraalVM), so resource allocation is explicit:
- Memory: Set the heap explicitly and the container limit above it:
JAVA_TOOL_OPTIONS=-Xmx512mon the JVM images,-Xmx512mpassed totenxon the native sidecar binaries, which otherwise take up to 80% of the container's memory, and a 768Mi limit for a 512m heap. Memory grows with the distinct pattern and container combinations the engine holds between flushes, at most 65,536 per aggregator, not with GB per day. - CPU: Set via
threadPoolSize, a fixed thread count (e.g.,2) or a fraction of available cores (e.g.,0.25= 25%). One or two dedicated threads handle most production volumes.
Backpressure throttles input when the pipeline falls behind. It does not cap memory; the heap setting does.
Both values map directly to standard Kubernetes resource specs in your DaemonSet manifest.
Do central aggregators count as nodes
The hosts that send to them do. A node is every host whose logs 10x handles: each server, VM or Kubernetes node that emits the logs 10x processes, whatever the topology. A central aggregator does not reduce the count; the hosts that send to it are the nodes.
Example: 400 VMs forwarding to 4 Fluentd aggregators that run 10x = 400 nodes.
What if I only use Retriever (no Edge)
Count the hosts whose logs ship to S3. Those are your billing units. See Retriever for details.
What if I only use the MCP SIEM-polling tool (no DaemonSet)
Free, not counted. The MCP server's SIEM-sample tool offers on-demand log analyzer polling without a DaemonSet: read-only analysis that samples a log platform, with no engine in the log path. Nodes count only where the 10x Engine processes logs.
Do analytics servers (Splunk, Elasticsearch, Datadog) count as nodes
No. Only hosts whose logs 10x handles count. Your analytics infrastructure, including Splunk indexers and Elasticsearch data nodes, is not a billing unit unless 10x handles its own logs.
Example: 200 EKS worker nodes running Filebeat DaemonSets + 30 Elasticsearch data nodes + 3 Splunk indexers = 200 nodes. Only the worker nodes whose logs 10x handles count.
Do Lambda functions count as nodes
No. Lambda functions and invocations are not billing units, including functions that run the 10x Engine. On AWS Lambda the engine runs as its own Lambda extension inside each function's execution environment, and events are regulated before the first byte leaves the function.
Pricing counts the hosts whose logs 10x handles, not the number of Lambda functions.
Do Fargate, Cloud Run, or serverless containers count
Serverless containers count; serverless functions do not. Fargate (ECS and EKS), Cloud Run, and Azure Container Apps convert at 10 average concurrent tasks = 1 node, declared from your cloud console. GKE Autopilot worker nodes count like any Kubernetes node. AWS Lambda and other FaaS stay free, as above.
Example: 300 average concurrent Fargate tasks = 30 nodes.
What if I deploy only to a subset of nodes
Count only the nodes whose logs 10x handles. If you use nodeSelector or nodeAffinity to deploy on 50 of your 200 worker nodes, your count is 50.
What if I use both the Reporter/Receiver and Retriever
Count each host whose logs 10x handles once. Retriever pods don't add to node count.
If you run the Reporter (DaemonSet) or Receiver (sidecar) on 200 nodes and also use Retriever on their logs, you pay for 200 nodes. Retriever and the MCP server are included at no extra charge.