Outbound to log10x
Three streams can reach log10x, all of them addressed by the same
backendEndpoint, and as shipped an engine sends none of them because that
endpoint is empty. Two are calls the engine makes about itself and neither
can stop a pipeline. The third is the pipeline's own per-pattern metrics,
which reach log10x only when an operator adds the log10x metric output.
| Property | Value |
|---|---|
| Engine version | 1.1.136 |
| Verified against | the shipped 1.1.136 release and images |
| Verified | 2026-10-07 |
What can be sent
| Call | Route | Method | Body | When |
|---|---|---|---|---|
| License enrichment | api/v1/agent/whoami |
GET | none | Once at startup, then retried at keepalive, at most once every 60 seconds, until it succeeds once |
| Metric write | api/v1/write |
POST | Prometheus remote-write of the engine's own health series, listed in Telemetry | Every flush tick |
| Per-pattern metrics | the configured metric output | POST | Event counts and byte volumes per pattern, listed in Telemetry | Every flush tick, when run/output/metric/log10x is in the config |
The shipped Receiver, Reporter and Retriever configs include no metric
output. Each lists the outputs an operator can turn on, all of them a
backend the customer owns: Prometheus (scrape, push gateway or remote
write), CloudWatch, Datadog, Elastic, or the log. The third row reaches
log10x only when run/output/metric/log10x is added and the endpoint is set.
Local ES256 verification against the public keys compiled into the binary is the license gate, so an unreachable endpoint logs a warning and the engine runs. A failed metric send trips a circuit breaker for the rest of the run rather than retrying on every tick.
When they happen
Two settings decide it.
| Setting | Ships as | Set it with |
|---|---|---|
backendEndpoint |
empty, which is no destination | TENX_BACKEND_ENDPOINT |
| License | none, so the engine runs the built-in evaluation license | TENX_LICENSE_KEY or TENX_LICENSE_FILE |
Three states, and only the third makes a call:
- No license configured. The launcher synthesizes the built-in evaluation license and forces air-gapped, whatever the endpoint says. A downloaded engine run without a token makes no call.
airgapped=true(TENX_AIRGAPPED). Honored for every license type, includingdemoandlimited, whatever the endpoint says.- A license plus a configured endpoint. Everything above is sent. This is the state a licensed deployment opts into by naming an endpoint.
In states 1 and 2 the engine builds an environment class that has no HTTP client, so the silence is structural rather than a flag on a live client.
What the shipped configuration produces
The shipped app configs leave backendEndpoint empty and the public images
carry no license, so a pulled image on the shipped config is in state 1: no
license, no endpoint, nothing sent. The engine links in no analytics SDK, no
crash reporting and no update check, so there is nothing beyond the streams
above to disable. Every other outbound destination in a running pipeline is
one the deployment configured.
Adding your own metric output does not stop engine telemetry
A metric output you add carries the
per-pattern stream to that destination. With backendEndpoint set, the
engine's own two calls still go to log10x whatever metric output is
configured. Clearing backendEndpoint or setting airgapped=true is
what stops them.
Next
| Page | What is on it |
|---|---|
| Verifying | The packet capture that settles each state, and the image check |
| Telemetry | Every field these streams carry, typed, with a PII column |