Skip to content

Local POC

Cost POC built from log lines pulled directly out of the prospect's Kubernetes cluster via kubectl. Use when no log analyzer connection is set up yet, or when API credentials aren't ready to share. Synchronous (no snapshot polling). Returns a sample-composition table, an industry-pricing matrix, and the top patterns in the sample.

The cost figures are list-price projections at Datadog / Splunk / CloudWatch / Sumo / Elastic / OpenSearch rates. They are NOT a prediction of any specific bill: kubectl only sees pod stdout, not CloudTrail / ALB / VM-hosted apps the log analyzer ingests. For a number tied to actual billed GB, use POC submit once credentials are available.

Example

"cost POC from kubectl, namespace production, 1h"

Pulled 38,420 lines (62 MB) across 17 pods over the last 1h.

Sample composition. Confirm this matches production before trusting the projection:

Pod Bytes % of sample
production/checkout-svc-7f9d-xk2z 24 MB 39%
production/payments-svc-5b3c-h7n1 12 MB 19%
production/cart-svc-2a8e-q4r6 8 MB 13%

Projected savings at industry list pricing (extrapolated to 1.5 TB/day):

Vendor Rate Annual cost Annual savings
Datadog $2.50/GB $1.37M $382K
Splunk $5.00/GB $2.74M $763K
CloudWatch $0.50/GB $274K $76K

Top patterns: Payment_Gateway_Timeout 18% of bytes · DB_Connection_Refused 11% · Cart_Eviction_Replay 9%.

More to ask

  • "cost POC from kubectl, all namespaces, 24h"
  • "local POC against default, top-10 pods only"
  • "local POC, 6h window, max 50 pods"

Prerequisites

kubectl on PATH with a working kubeconfig. Privacy mode (default) also needs the CLI installed locally (brew install log10x/tap/tenx).

There is no automatic fallthrough from POC submit when log analyzer credentials are missing. The two paths frame cost differently. Submit predicts the prospect's actual bill; this tool emits an industry matrix. Switching framing silently would be a bait-and-switch, so the call is always explicit.

Tool schema (advanced)
Field Type Required Default Description
source string no kubectl Where to pull lines from. Currently kubectl only; docker and journald are follow-up work.
namespace string no default Kubernetes namespace. Pass * to sample across all namespaces.
window string no 1h How far back to read per pod. Accepts 1h, 24h, etc.
per_pod_limit number no 5000 Cap on log lines pulled per pod. 100–50000.
max_pods number no 20 Cap on number of pods sampled. 1–200. Random selection across the namespace.
privacy_mode boolean no true Templating runs through the local tenx CLI when true; routes through the public Log10x paste endpoint when false.

Sample composition is mandatory. The first section of the report is a top-10-pods-by-byte-volume table with percentages. Confirm the sample looks like production before trusting the projection. If 70% of real-prod bytes come from a service that is not in the list, widen with namespace: "*" or a longer window.

Pods that fail to read (access denied, terminated, kubectl error) are reported as a tail count in the report metadata.