Reporter

Discovery snapshot + install choices (forwarder, release name, namespace, license key, destination) → structured markdown plan for standing up the Reporter. Paste-ready: no template variables to fill in. The plan is a checklist; nothing is executed by the tool.

Example

"Reporter plan, fluent-bit, mock destination"

# Install
helm repo add log10x https://charts.log10x.io
helm upgrade --install my-reporter log10x/fluent-bit-10x \
  --namespace logging \
  --set log10x.apiKey=lx_live_... \
  --set log10x.destination=mock
kubectl -n logging rollout status ds/my-reporter

# Verify
kubectl -n logging get pods -l app=my-reporter
  # expect: 3/3 Running
kubectl -n logging logs ds/my-reporter -c log10x-sidecar --tail=20
  # expect: "Reporter started, watching <forwarder>"

# Teardown
helm uninstall my-reporter --namespace logging

More to ask

• "Reporter standalone, fluentd, into obs namespace"
• "verify probes only — install already ran"
• "teardown plan for my-reporter"

Prerequisites

A fresh snapshot_id from Discover env.

Tool schema (advanced)

Field	Type	Required	Default	Description
snapshot_id	string	yes	—	ID returned by Discover env. Cached for 30 min.
shape	string	no	inline	inline (repackage the forwarder chart with the sidecar) or standalone (install reporter-10x as a parallel DaemonSet, zero-touch).
forwarder	string	no	detected	fluent-bit / fluentd / filebeat / logstash / otel-collector. Drives chart selection when shape=inline.
release_name	string	no	my-reporter	Helm release name. Must not collide with an existing release.
namespace	string	no	snapshot's suggested namespace	Target namespace.
api_key	string	no	—	Log10x license key. Required for a complete install plan; verify and teardown work without it.
destination	string	no	auto, mock if none	mock / elasticsearch / splunk / datadog / cloudwatch. Auto-detected when exactly one set of log-analyzer creds is present in the env; falls back to mock when nothing is detected; returns "ambiguous" when multiple are detected.
output_host	string	no	—	Host for non-mock destinations.
splunk_hec_token	string	when destination=splunk	—	HEC token.
action	string	no	all	Which sections to emit. One of: install, verify, teardown, all.

Inline vs standalone:

• inline replaces the forwarder deployment with a Log10x-repackaged chart (fluent-bit-10x, fluentd-10x, etc.). Pick when the forwarder is Helm-managed on a chart version the advisor knows how to upgrade.
• standalone installs reporter-10x as a parallel DaemonSet. Zero-touch — the forwarder isn't modified. Report-mode only (no filter, no compact). Pick when the forwarder is hand-rolled, or to avoid touching the existing deployment.

Blockers: missing api_key (install only) · Filebeat with output.console (corrupts the stdout pipe to tenx).