POC from local logs (kubectl)

Previous value: -"DOLLAR BUDGET: keep the projected monthly bill on the assumed SIEM at or under this $/mo. The sample is scaled to a 30-day month (kubectl window, or file timestamp span) before solving, so the budget and the bill share a denominator. Mutually exclusive with target_percent_reduction and budget_gb_monthly."New value: +"DOLLAR BUDGET: keep the projected monthly bill on the assumed SIEM at or under this $/mo. The sample is scaled to a 30-day month (kubectl window, or the file span) before solving, so the budget and the bill share a denominator. Mutually exclusive with target_percent_reduction and budget_gb_monthly."

Added value: +{
+  "description": "Datadog only, default true: before the plan moves statements off Standard, read the account's log monitors and log-based metrics (read-only GETs, needs DD_API_KEY + DD_APP_KEY in the session) and print beside each service line the ones whose query reads its moved lines. Set false to skip the read.",
+  "type": "boolean"
+}

Added value: +{
+  "additionalProperties": false,
+  "description": "Set the fleet default from this capture: the limit for every service the plan gives no row, the largest statement the plan keeps per node times the headroom. The report states it in lines a day, and `fleet_default.cap_bytes_per_window_per_node` in the result is the value `log10x_advise_install` writes. On Datadog, the dependency check also lists the log monitors and log-based metrics of the services it covers, error monitors included.",
+  "properties": {
+    "action": {
+      "description": "Where a statement above the limit goes: `tier_down` (Flex on Datadog, the default) or `offload` (S3).",
+      "enum": [
+        "tier_down",
+        "offload"
+      ],
+      "type": "string"
+    },
+    "error_floor": {
+      "description": "Share of ERROR and CRITICAL lines above the limit kept in Standard. Default 0.5 with offload, 0 with tier_down.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    },
+    "headroom": {
+      "description": "Multiplier on the largest kept per-node cell of the capture. Default 2.",
+      "maximum": 10,
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "type": "object"
+}

Previous value: -"Forwarder in the pipeline (fluentd, fluent-bit, filebeat, logstash, otel-collector, vector, hec). Used to pick verified apply/undo commands. Not guessed when absent — the report says commands are unavailable."New value: +"Forwarder in the pipeline (fluentd, fluent-bit, filebeat, logstash, otel-collector, vector, hec). Used to pick verified apply/undo commands. Not guessed when absent: the report says commands are unavailable."

Previous value: -"Advanced — most customers will not need this. Map of pattern_hash to action for rare per-pattern overrides within a pod / source. Applied AFTER pin_services."New value: +"Advanced: most customers will not need this. Map of pattern_hash to action for rare per-pattern overrides within a pod / source. Applied AFTER pin_services."

Added value: +{
+  "description": "Bytes of forwarder metadata per record, for a capture that carries the log text only (a kubectl sample or plain lines). The Receiver counts each record as the forwarder sends it, metadata included, so the caps add this to every line. Default 760, the median of a Fluent Bit kubernetes record on an EKS capture. A file of the forwarder's own JSON records is measured instead.",
+  "maximum": 100000,
+  "minimum": 0,
+  "type": "integer"
+}

Previous value: -"Whether the prospect will install the S3 retriever. Gates the offload rung of the plan ladder: without it offloaded events would be unreachable, so the plan stops at the in-SIEM levers and the gap names \"install the retriever\" as the lossless remedy. Set from conversation."New value: +"Whether the prospect will install the S3 retriever. Gates the offload rung of the plan ladder: without it offloaded events would be unreachable, so the plan stops at the in-SIEM levers and the gap names \"install the retriever\" as the keep-everything remedy. Set from conversation."

Previous value: -"Where to pull log lines from. `kubectl` samples pod logs; `file` samples local logs — pass `paths` (files, directories, globs) or `path` (one file; fluentd/k8s/docker-wrapped JSONL is detected and normalized before the engine sees it). `docker` and `journald` are follow-up work."New value: +"Where to pull log lines from. `kubectl` samples pod logs; `file` samples local logs: pass `paths` (files, directories, globs) or `path` (one file; fluentd/k8s/docker-wrapped JSONL is detected and normalized before the engine sees it). `docker` and `journald` are follow-up work."

Removed value: -"1h"

Previous value: -"How far back to read per pod (`source: kubectl`). For `source: file` this is the time span you declare the sampled file tails to cover — it drives the daily projection, so set it if you know it. Accepts `1h`, `24h`, etc. Default `1h`."New value: +"How far back to read per pod (`source: kubectl`, default `1h`). For `source: file`, the time span the files cover: read from the first and last record timestamps when the records carry them, and from `window` when they do not. With neither, a file run refuses rather than assume a span. Accepts `30m`, `10h`, `7d`, etc."