Outbound to log10x
Three streams can reach log10x, all of them addressed by the same
backendEndpoint, and as shipped an engine sends none of them because that
endpoint is empty. Two are calls the engine makes about itself and neither
can stop a pipeline. The third is the pipeline's own per-pattern metrics,
which the shipped configs point at log10x.
| Property | Value |
|---|---|
| Engine version | 1.1.74 |
| Verified against | the shipped 1.1.74 release and images |
| Verified | 2026-09-02 |
What can be sent
| Call | Route | Method | Body | When |
|---|---|---|---|---|
| License enrichment | api/v1/agent/whoami |
GET | none | Once at startup, then retried at keepalive, at most once every 60 seconds, until it succeeds once |
| Metric write | api/v1/write |
POST | Prometheus remote-write of the engine's own health series, listed in Telemetry | Every flush tick |
| Per-pattern metrics | the configured metric output | POST | Event counts and byte volumes per pattern, listed in Telemetry | Every flush tick, when run/output/metric/log10x is in the config |
The shipped Receiver, Reporter and Retriever index and stream configs
include run/output/metric/log10x, so on those configs the third row shares
the endpoint with the first two. Commenting that include out, or adding a
metric output of your own, sends the stream elsewhere.
Local ES256 verification against the public keys compiled into the binary is the license gate, so an unreachable endpoint logs a warning and the engine runs. A failed metric send trips a circuit breaker for the rest of the run rather than retrying on every tick.
When they happen
Two settings decide it.
| Setting | Ships as | Set it with |
|---|---|---|
backendEndpoint |
empty, which is no destination | TENX_BACKEND_ENDPOINT |
| License | none, so the engine runs the built-in evaluation license | TENX_LICENSE_KEY or TENX_LICENSE_FILE |
Three states, and only the third makes a call:
- No license configured. The launcher synthesizes the built-in evaluation license and forces air-gapped, whatever the endpoint says. A downloaded engine run without a token makes no call.
airgapped=true(TENX_AIRGAPPED). Honored for every license type, includingdemoandlimited, whatever the endpoint says.- A license plus a configured endpoint. Everything above is sent. This is the state a licensed deployment opts into by naming an endpoint.
In states 1 and 2 the engine builds an environment class that has no HTTP client, so the silence is structural rather than a flag on a live client.
What the shipped configuration produces
The shipped app configs leave backendEndpoint empty and the public images
carry no license, so a pulled image on the shipped config is in state 1: no
license, no endpoint, nothing sent. The engine links in no analytics SDK, no
crash reporting and no update check, so there is nothing beyond the streams
above to disable. Every other outbound destination in a running pipeline is
one the deployment configured.
Adding your own metric output does not stop engine telemetry
A metric output you add is an extra
destination, not a replacement: the per-pattern stream then goes to both
until run/output/metric/log10x is commented out, and the engine's own
two calls are unaffected either way. Clearing backendEndpoint or
setting airgapped=true is what stops everything.
Next
| Page | What is on it |
|---|---|
| Verifying | The packet capture that settles each state, and the image check |
| Telemetry | Every field these streams carry, typed, with a PII column |