{
  "$comment": "Every label and metric a deployed 10x Engine can send to log10x. Companion to https://doc.log10x.com/security/telemetry/. Each entry was read from the source that emits it.",
  "schema_version": "1",
  "engine_version": "1.1.74",
  "verified": "2026-09-02",
  "read_from": [
    "the shipped 1.1.74 release and images"
  ],
  "default_posture": {
    "engine_fallback_backend_endpoint": "",
    "shipped_app_config_backend_endpoint": "",
    "shipped_app_config_override_env": "TENX_BACKEND_ENDPOINT",
    "apps_that_set_it": [
      "receiver",
      "reporter",
      "retriever/index",
      "retriever/query",
      "retriever/stream",
      "mcp",
      "mcp-file",
      "compiler",
      "dev"
    ],
    "sends_by_default": false,
    "note": "The engine's built-in default and every shipped app config leave backendEndpoint empty, so a deployment following the install guide points nowhere. Naming an endpoint is what puts a licensed engine into the reporting state.",
    "states": [
      {
        "state": "no license configured",
        "outbound": "none",
        "why": "the launcher runs the built-in evaluation license and forces airgapped, whatever the endpoint says"
      },
      {
        "state": "TENX_AIRGAPPED=true",
        "outbound": "none",
        "why": "honored for every license type; the engine builds an environment that has no HTTP client"
      },
      {
        "state": "licensed, with an endpoint configured",
        "outbound": "both calls in outbound_calls[]",
        "why": "a license is present so the evaluation path is not taken, and the deployment names an endpoint via TENX_BACKEND_ENDPOINT"
      }
    ],
    "public_images": "The public images carry no license, so a pulled image takes the built-in evaluation path and makes no outbound call. Verified against ghcr.io/log-10x/fluent-bit-10x:1.1.74-native."
  },
  "outbound_calls": [
    {
      "name": "license_enrichment",
      "route": "api/v1/agent/whoami",
      "method": "GET",
      "body": null,
      "auth": "Authorization: Bearer <license JWT>",
      "when": "Once at startup, then retried at keepalive, at most once every 60 seconds, until it succeeds once",
      "blocking": false,
      "source": "The startup license check, and the user enrichment it returns"
    },
    {
      "name": "metric_write",
      "route": "api/v1/write",
      "method": "POST",
      "body": "Prometheus remote-write of the series listed in metrics[]",
      "auth": "Authorization: Bearer <license JWT>",
      "when": "Every flush tick",
      "blocking": false,
      "source": "The metric write on each flush tick"
    }
  ],
  "suppressed_by": [
    {
      "condition": "no license configured",
      "note": "Built-in evaluation license, forced air-gapped by the launcher. The public images carry no license, so a pulled image takes this path"
    },
    {
      "condition": "airgapped=true (TENX_AIRGAPPED)",
      "note": "Honored for every license type, including demo and limited. This is the setting that ends outbound calls"
    }
  ],
  "common_labels": [
    {
      "label": "__name__",
      "type": "string",
      "example": "tenx_pipeline_up",
      "source": "Prometheus series name",
      "pii": false
    },
    {
      "label": "tenx_reported_name",
      "type": "string",
      "example": "edge-receiver",
      "source": "Pipeline display name from the config",
      "pii": false
    },
    {
      "label": "tenx_pipeline_uuid",
      "type": "string",
      "example": "a1b2c3d4-e5f6-...",
      "source": "Generated per pipeline run",
      "pii": false
    },
    {
      "label": "tenx_host_name",
      "type": "string",
      "example": "edge-node-1",
      "source": "The host lookup at startup, or Unknown when it fails",
      "pii": "review",
      "note": "A hostname. On Kubernetes this resolves to the pod name, which encodes the workload and namespace."
    },
    {
      "label": "tenx_parent_uuid",
      "type": "string",
      "example": "9f8e7d6c-...",
      "source": "Parent pipeline id, present only when one is set",
      "pii": false
    }
  ],
  "conditional_labels": [
    {
      "label": "tenx_unit_name",
      "type": "string",
      "example": "receive",
      "appears_on": [
        "tenx_launch_failure_total"
      ],
      "pii": false
    },
    {
      "label": "tenx_pipeline_factory",
      "type": "string",
      "example": "run",
      "appears_on": [
        "tenx_launch_failure_total"
      ],
      "pii": false
    },
    {
      "label": "tenx_failure_reason",
      "type": "string",
      "example": "missing unit",
      "appears_on": [
        "tenx_launch_failure_total"
      ],
      "pii": "review",
      "note": "A fixed string (missing unit, unit init error) for the two classified failures, otherwise the launch exception's message, which can include a config path or a unit name. Never log content: launch fails before any event is read."
    }
  ],
  "operator_extensible": {
    "field": "runtimeAttributes",
    "form": "name:value pairs supplied at launch, each name prefixed with tenx_ if it is not already",
    "note": "Whatever an operator puts here is sent. This is the one place a deployment can widen this schema itself.",
    "source": "Operator-supplied runtimeAttributes, sent as given"
  },
  "metrics": [
    {
      "metric": "tenx_pipeline_up",
      "type": "gauge",
      "unit": "boolean",
      "measures": "Pipeline is running. Emitted on every send, including the empty keepalive",
      "value_kind": "numeric"
    },
    {
      "metric": "tenx_pipeline_bootstrap_time_seconds",
      "type": "timer",
      "unit": "seconds",
      "measures": "Time from launcher construction to the pipeline starting",
      "value_kind": "numeric"
    },
    {
      "metric": "tenx_pipeline_input_time_seconds",
      "type": "timer",
      "unit": "seconds",
      "measures": "Time the input stage ran",
      "value_kind": "numeric"
    },
    {
      "metric": "tenx_pipeline_runtime_seconds",
      "type": "timer",
      "unit": "seconds",
      "measures": "Total pipeline runtime",
      "value_kind": "numeric"
    },
    {
      "metric": "tenx_pipeline_invocation_time_seconds",
      "type": "timer",
      "unit": "seconds",
      "measures": "Runtime of one invocation, for invocation-shaped launchers such as Lambda",
      "value_kind": "numeric"
    },
    {
      "metric": "tenx_launch_failure_total",
      "type": "counter",
      "unit": "count",
      "measures": "A pipeline failed to launch",
      "value_kind": "numeric"
    }
  ],
  "metric_values": {
    "note": "Every value is a number: a count or a duration. No metric value carries a string, so no metric value can carry log content."
  },
  "pipeline_metrics": {
    "note": "Per-pattern metrics (all_events_summaryBytes_total and the rest) are a separate stream that goes wherever the pipeline's metric output points. The shipped Receiver, Reporter and Retriever index and stream configs include run/output/metric/log10x, which reads the same backendEndpoint as the two calls above. Metric outputs are additive, so adding your own sends the stream there as well until that include is removed; clearing backendEndpoint or setting airgapped=true stops everything.",
    "reference": "https://doc.log10x.com/api/metrics/"
  },
  "sources": [
    "the shipped 1.1.74 release and images"
  ]
}