Estimate savings
log10x_estimate_savingsRead-onlyIdempotent
Estimate log cost savings by forecasting proposed plans or verifying realized reductions, with percent reduction and dollar overlay.
Instructions
[FRESH-SESSION ROUTING: if this is the user first cost question of the session, call log10x_start first instead — it returns the orientation menu the user needs before any per-tool action.] Two-mode savings estimator with percent-first reporting and a dollar overlay. forecast projects bytes_in -> bytes_out and percent reduction for a proposed plan; pass effective_ingest_per_gb (or rely on the account profile list-price rate) to overlay $/mo per pattern and in totals. verify counts realized savings from the engine routeState label over a window with cap-hit / drift / new-patterns / leakage attribution, leading with percent and adding the dollar overlay only when a rate is set. Without a rate, dollar fields are emitted as null (never as a fabricated $1/GB number); the envelope carries rate_source: list_price | customer_supplied | unset so callers can show how the overlay was derived. Accepts siem_lens (what-if destination): keeps the real volumes, prices + gates for that destination at list rates, and stamps siem_actual vs siem_lens in the envelope. REQUIRES Reporter-tier cost attribution (per-pattern bytes in the metrics backend). Before anything is deployed, use log10x_poc_from_local or log10x_poc_from_siem_submit instead.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | forecast: project savings of a proposed per-pattern policy (or a target_percent). verify: measure realized savings from a deployed policy by comparing baseline vs post-merge windows. | forecast |
| service | No | Scope the target_percent greedy solver and coverage_pct to a single service. When present, only patterns from that service are candidates; coverage_of_env_pct and dollar totals reflect that service only. pattern_limit is ignored (all service patterns are returned). If omitted, runs across all services. | |
| es_pruned | No | Elasticsearch only: are compactable fields excluded from _source? Default false — the unpruned ratio band is used. | |
| siem_lens | No | What-if destination lens (alias of `destination` with provenance stamping): price the projection for THIS destination while the pipeline keeps its actual one. Envelope stamps siem_actual vs siem_lens. | |
| timeRange | No | forecast mode: alias for `observation_window` for consistency with other Log10x tools. If both are set, `observation_window` wins. | |
| deployment | No | How the customer RUNS the destination, which decides whether compaction is available at all: the expander is software they install (the l1es Elasticsearch/OpenSearch plugin, the 10x Splunk app), so a managed or serverless platform can carry compacted bytes but has nowhere to expand them. Set only from what the user actually said — absent means unknown, and an unknown deployment prices only the levers that hold either way. Irrelevant on destinations whose levers do not depend on it (Datadog, CloudWatch, Azure, Coralogix). | |
| allow_lossy | No | Permit the ladder solver to close a keep-everything shortfall with sample/drop (lossy, opt-in). Default false: the plan stops at the keep-everything ceiling and reports the gap instead of silently discarding events. Only set after the user explicitly chooses loss. | |
| destination | No | Destination stack. Required for both modes (used to look up ingest $/GB + compact ratio band). | |
| environment | No | Environment nickname; routes to the right metrics backend. | |
| post_window | No | verify mode: PromQL range expression for the post-merge window, e.g. "7d". | |
| commitment_id | No | verify mode: when present, the verify output is shaped as a commitment delta (used by log10x_commitment_report). | |
| contract_type | No | verify mode: shapes the dollar projection (committed vs on-demand renewal math). | |
| pattern_limit | No | forecast mode: maximum number of per_pattern rows returned. Default 50 when service is omitted; ignored (unlimited) when service is set. Totals and coverage_pct are always computed over the full solver result before slicing. | |
| default_action | No | forecast mode, OPTIONAL: force one action onto every solver-selected pattern (a mode choice — "cut 50% via drop"). Hard constraint when present, subject to destination compatibility (compact is replaced by the destination canonical action when compact_mode=no-op). OMIT for the product default: the ladder solver picks the destination's keep-everything lever per pattern (compact -> tier_down -> offload-with-retriever), never lossy unless allow_lossy. | |
| target_percent | No | forecast mode: % volume reduction goal. Tool runs the same greedy solver as configure_engine on observed 30d bytes. | |
| tier_down_plan | No | Which tier_down plan to price when the action is tier_down. Matches the plan name (case-insensitive substring): omit for the destination default (e.g. Azure Basic Logs), or pass e.g. "auxiliary" to price the aggressive alternative (Azure Auxiliary Logs). No effect on destinations without an alternative tier. | |
| baseline_window | No | verify mode: PromQL range expression for the pre-merge window, e.g. "7d", "168h". | |
| proposed_config | No | forecast mode: explicit per-pattern (action, optional cap) rows. Either this OR target_percent is required. | |
| enforcement_mode | No | forecast mode: when manual_report, reframes the headline as a potential-savings estimate under external enforcement rather than engine enforcement. Headline reads 'If you enforce externally: X savings potential. Enforcement choice is yours.' instead of the standard forecast headline. | |
| retention_months | No | Retention window for storage cost. Default 1 month. | |
| budget_gb_monthly | No | forecast mode: VOLUME BUDGET — keep monthly ingest toward the destination at or under this many GB/mo. BYTE accounting: tier_down keeps every byte in the destination, so it cannot serve this target and is excluded from the ladder (compact only where it lands on the billed wire, then offload with the retriever, then lossy on allow_lossy). Mutually exclusive with target_percent, budget_usd_monthly, default_action, and proposed_config. | |
| monthly_volume_gb | No | What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only absolute bytes and dollars scale, by one uniform factor. Use it to project a prospect onto their own scale, or to forecast a real env after growth. Pairs with `siem_lens`. This is a PROJECTION: the envelope stamps volume_actual_gb vs volume_projected_gb and the scale factor, and the note points at the POC for the caller's real patterns. | |
| budget_usd_monthly | No | forecast mode: DOLLAR BUDGET — keep the (service-scoped or whole) destination bill at or under this $/mo. The ladder solver derives the reduction: max(0, bill - budget). Idempotent: already under budget returns an empty plan with the headroom stated. Mutually exclusive with target_percent, budget_gb_monthly, default_action, and proposed_config. | |
| check_dependencies | No | Ladder-plan path only: scan the destination (read-only) for dashboards, alerts, and saved searches that reference the top planned message types, and attach the result as plan_dependencies. Runs only when credentials for the destination are present in the session environment; otherwise the plan carries a one-line note saying it was not checked. Set false to skip the scan for speed. | |
| exception_services | No | Ladder-plan path only: services pinned at pass — their patterns stay in the bill but are never planned, exactly like protected severities. The SOC-owned or compliance-bound slice of the estate, stated as a hard exclusion. Case-insensitive. | |
| include_referenced | No | Ladder-plan path only: message types LITERALLY referenced by a monitor, alert, saved search, or dashboard (found by the dependency scan) are EXCLUDED from the plan by default — they stay exactly as they are, and the plan re-solves around them. Pass true only after the user explicitly chooses to include them (the render shows what including them adds). | |
| observation_window | No | forecast mode: PromQL range expression for the observation window the solver/projection runs over. Default `30d`. Accepts `1h`, `24h`, `7d`, `30d`, etc. Alias: `timeRange`. | |
| unprotect_patterns | No | Ladder-plan path only: pattern hashes the user EXPLICITLY unpinned from the severity floor (a warn-level retry storm they chose to act on). Bypasses severity protection for the listed hashes only; hard exclusions still win. Set only after the user names the type and chooses this — never inferred. The render flags these rows with their severity. | |
| retriever_installed | No | Whether the S3 retriever is installed (or the user has agreed to install it). Gates the offload rung of the ladder solver: without it, offloaded events would be unreachable, so the plan stops at the in-SIEM levers and the gap names "install the retriever" as the lossless remedy. Set from conversation; log10x_advise_retriever is the install path. | |
| effective_ingest_per_gb | No | forecast and verify mode: override the destination list-price rate with the customer's contracted $/GB. When supplied, dollar projections use this rate and surface rate_source='customer_supplied'. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | ||
| tool | Yes | ||
| view | No | summary | |
| images | No | ||
| actions | No | ||
| summary | Yes | ||
| warnings | No | ||
| truncated | No | ||
| next_cursor | No | ||
| render_hint | No | ||
| generated_at | Yes | ||
| schema_epoch | Yes | ||
| schema_version | Yes |