Skip to content

Compatibility

Whether 10x changes your Datadog setup, which forwarders it supports, how it works with Log Pipelines, how to try it from your AI client, the ROI timeline, and how to roll back.

Compatibility

Does 10x require changes to my Datadog configuration

No. Your Datadog organization, Log Pipelines, dashboards, alerts, and saved views all keep working exactly as before.

You drive 10x from your AI client through the MCP server: it reads your Datadog over the API (read-only), recommends a per-pattern plan, and generates the engine config for you to approve. It never writes to your cluster or your Datadog org directly, it proposes configs (Helm values or a GitOps PR) that you review.

The components the agent configures:

  • Receiver (sidecar to your forwarder): the execution arm. Filter mode (cost-aware sampling) and tier_down (route low-value patterns to a Datadog Flex Logs index) run on events before they reach the Standard index. Compact mode is for the S3 offload path, not a Datadog-ingest lever.
  • Reporter (DaemonSet): pre-SIEM cost visibility, not in the critical log path.
  • Retriever: reads offloaded events back from your own S3.
What log forwarders does log10x support

All major log forwarders are supported.

Native plugin integrations:

File relay integrations:

Deployment: the agent scans your environment and generates the wiring. The Reporter deploys as a DaemonSet alongside your existing forwarders; the Receiver deploys as a sidecar to them. Integration requires minimal changes to your existing setup.

How does this work with Datadog Log Pipelines

Log Pipelines continue working normally.

The 10x Engine operates at the edge before logs reach Datadog. Optimized logs maintain their original structure and are parsed, enriched, and routed by your existing pipeline rules without any modifications needed.

Compatibility: Grok parsers, remappers, category processors, and all other pipeline processors work identically with optimized logs.

Getting Started

How do I try this on my Datadog environment
  1. Install the MCP server into your AI client (Claude, Cursor, and others) and ask it for a cost POC on your Datadog. It connects to Datadog over the API (agentless, read-only), ranks the patterns driving your bill, and proposes a per-pattern plan, no deploy needed to see the analysis.
  2. Prefer a local, no-account preview? Run Dev on a Datadog export, or ask the agent to run it for you.
  3. When you're ready to act, ask the agent to generate the Receiver deployment, Helm values or a GitOps PR you approve. Filter mode caps noisy events; tier_down routes low-value patterns to a Datadog Flex Logs index; offload sends the rest to your S3.
  4. Retriever fetches offloaded events back from S3 on-demand.

Each step is independent. Start with the cost POC to see your reduction ratio, then deploy when ready.

Can I see which log types are costing the most

Yes, ask the agent. Through the MCP server, ask what's driving your Datadog cost. It analyzes your Datadog logs over the API (agentless) and ranks event types, services, and sources by volume and cost.

For continuous pre-SIEM visibility, deploy the Reporter DaemonSet. Either way you get breakdowns by service, source, log level, and custom dimensions.

What's the typical ROI timeline
  • Day 1: Ask the agent for a cost POC on your Datadog (agentless, via the API), or deploy the Reporter for pre-SIEM visibility.
  • Week 1-2: Have the agent generate the Receiver deployment (Helm values or a GitOps PR you approve). Filter mode caps noisy events; tier_down routes low-value patterns to a Flex Logs index; offload sends the rest to your S3.
  • Week 3-4: Measure sustained reduction in the Datadog bill. tier_down to Flex Logs cuts the dominant index cost on the down-tiered slice; offload to S3 removes patterns from Datadog entirely; Filter mode caps the rest. (Compact mode reduces S3 storage, not the Datadog bill.)

Start by asking the agent for the POC before deploying anything.

Is the deployment reversible? Can I roll back

Yes, 100% reversible. Rolling back takes minutes:

  • Remove the Receiver sidecar (or revert the GitOps PR the agent opened) and roll out the change
  • No data migration: your Datadog organization is unchanged, same indexes, same pipelines
  • No downtime: switch traffic with a config reload (no restart required)

Why it's safe: 10x doesn't modify your Datadog organization settings, log pipelines, or dashboards. The Receiver sidecar processes events before they reach Datadog; the Reporter DaemonSet reads pre-SIEM without touching the log path; the MCP tools read via API or S3 (read-only) and only ever propose changes you approve.