Services
log10x_servicesList all services Log10x watches ranked by byte volume and cost, with per-service share and drop/offload/compact/pass action columns to pinpoint where log spend goes and what to optimize.
Instructions
[FRESH-SESSION ROUTING: if this is the user first cost question of the session, call log10x_start first instead — it returns the orientation menu the user needs before any per-tool action.] List every service the Log10x pipeline is watching, ranked by byte volume (with cost overlay when $/GB is set) plus per-service share of total AND the four action-axis columns (bytes_passed / bytes_offloaded / bytes_compacted / bytes_dropped) derived by joining routeState="drop" events against the cap-CSV. Pass exception_services to mark customer-flagged services as current_mode=pass — their next_action points at log10x_pattern_mitigate instead of log10x_configure_engine. Call first on open-ended cost questions, before drilling into a specific service.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. Always "summary" — the typed envelope (data.services[], data.totals). Field retained for backward-compat. | summary |
| siem_lens | No | What-if destination lens: price the per-service $/mo columns at this destination's list rates instead of the connected pipeline's (env-configured rates never cross destinations). Volumes/patterns are unaffected; the envelope stamps siem_actual vs siem_lens. | |
| timeRange | No | Time range. Sub-day values available for incident-window service ranking. '24h' and '1d' are equivalent. | 7d |
| environment | No | Environment nickname | |
| analyzerCost | No | SIEM ingestion cost in $/GB | |
| monthly_volume_gb | No | What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only absolute bytes and dollars scale, by one uniform factor. Use it to project a prospect onto their own scale, or to forecast a real env after growth. Pairs with siem_lens. This is a PROJECTION: the envelope stamps volume_actual_gb vs volume_projected_gb and the scale factor, and the note points at the POC for the caller real patterns. | |
| exception_services | No | Customer-flagged services that must stay in the SIEM with full retention (audit / regulatory / executive). Per row, marks current_mode="pass" and points next_action at pattern_mitigate instead of the configure_engine bulk path. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | ||
| tool | Yes | ||
| view | No | summary | |
| images | No | ||
| actions | No | ||
| summary | Yes | ||
| warnings | No | ||
| truncated | No | ||
| next_cursor | No | ||
| render_hint | No | ||
| generated_at | Yes | ||
| schema_epoch | Yes | ||
| schema_version | Yes |