log10x-mcp 1.30.35 → 1.30.36

package/build/product-kb/docs/apps/mcp/tools/orient/cost-options.md

@@ -30,7 +30,7 @@ Three compliance levers (same shape as log10x_start):
       1. **drop**: stop events at the forwarder. Nothing reaches the SIEM.
       2. **sample**: keep 1 in N events. Trends stay valid.
       3. **compact**: minify events losslessly (Splunk, self-hosted Elasticsearch). All events still land in the SIEM.
-      4. **tier_down**: SIEM stores events at a cheaper storage tier.
+      4. **tier_down**: the SIEM keeps events in a cheaper tier.
         _(not available: tier_down maps to billing reductions only on Datadog/CloudWatch/Azure Monitor. Detected SIEM: splunk.)_
       5. **offload**: events route to your S3 bucket instead of the SIEM.
       6. **observe_only**: 10x marks patterns in metrics; nothing is dropped.

package/build/product-kb/docs/apps/mcp/tools/orient/explain-mode.md

@@ -68,7 +68,7 @@ Reporter deployed (for volume figures). Volume data is best-effort; the card ren
             "drop",
             "observe_only"
           ],
-          "description": "Which enforcement mode to explain. Keep-everything levers come first, then the lossy opt-ins. `compact` = keeps everything: engine minifies events losslessly; all events still reach the stack. `offload` = keeps everything: engine diverts matched events to a customer-owned S3 bucket; readable via log10x_retriever_query. `tier_down` = keeps everything: engine stamps the routeState marker; a routing rule moves those events to a cheaper storage tier (Datadog Flex / CloudWatch IA / Azure Monitor Basic or Auxiliary Logs). `sample` = lossy opt-in: engine passes 1-in-N events through to the stack; the rest are discarded. `drop` = lossy opt-in: engine hard-drops matched patterns at the Receiver before delivery. `observe_only` = engine observes and fingerprints but does not act; use to baseline volume before committing."
+          "description": "Which enforcement mode to explain. Keep-everything levers come first, then the lossy opt-ins. `compact` = keeps everything: engine minifies events losslessly; all events still reach the stack. `offload` = keeps everything: engine diverts matched events to a customer-owned S3 bucket; readable via log10x_retriever_query. `tier_down` = keeps everything: engine stamps the routeState marker; a routing rule moves those events to a cheaper tier in the same destination (Datadog Flex / CloudWatch IA / Azure Monitor Basic or Auxiliary Logs). `sample` = lossy opt-in: engine passes 1-in-N events through to the stack; the rest are discarded. `drop` = lossy opt-in: engine hard-drops matched patterns at the Receiver before delivery. `observe_only` = engine observes and fingerprints but does not act; use to baseline volume before committing."
         },
         "destination": {
           "type": "string",

package/build/product-kb/docs/apps/receiver/faq.md

@@ -23,7 +23,7 @@ The [Receiver](https://doc.log10x.com/apps/receiver/) is the execution arm of th
     - **pass**: forward unchanged.
     - **sample**: forward a rate-limited share against a per-pattern budget. Uses automatic [message enrichment](https://doc.log10x.com/run/initialize/message/){target="_blank"} to identify event types by their symbol identity and calculate ingestion cost per event (bytes × $/GB). When an event type exceeds its share of the budget, the Receiver samples it down, in real time at the source, before expensive data reaches your analyzer. A [severity floor](https://doc.log10x.com/run/receive/rate/){target="_blank"} keeps a minimum share of ERROR and WARN events flowing even when their pattern is over its cap.
     - **compact**: replace repeated lines with an encoded form the destination expands at query time, with no dashboard changes. Lossless only on Splunk (up to 256 KB per event) and self-hosted Elasticsearch/OpenSearch with the expand plugin installed ([Splunk](compact/splunk.md), [Elasticsearch](compact/elasticsearch.md)). It is a no-op on managed/SaaS destinations (Datadog, CloudWatch, Azure, GCP, Sumo, managed Elasticsearch).
-    - **tier_down**: tag the pattern for a cheaper storage tier the destination enforces (Datadog Flex, CloudWatch IA, Azure Monitor Basic/Auxiliary).
+    - **tier_down**: tag the pattern for a cheaper tier the destination enforces (Datadog Flex, CloudWatch IA, Azure Monitor Basic/Auxiliary).
     - **offload**: route the pattern to customer-owned object storage (S3 or any S3-compatible bucket) instead of the destination.
     - **drop**: stop forwarding the pattern.
 

package/build/product-kb/docs/apps/receiver/run.md

@@ -14,7 +14,7 @@ The actions:
 - **pass**: forward unchanged.
 - **sample**: forward a rate-limited share against a per-pattern budget.
 - **compact**: replace repeated lines with an encoded form the destination expands (lossless only where the destination supports it: Splunk up to 256 KB per event, self-hosted Elasticsearch; a no-op elsewhere). Requires the expand plugin installed in [Splunk](compact/splunk.md) or [Elasticsearch](compact/elasticsearch.md). On ClickHouse the lever is offload, not compact: the per-pattern cap sends overflow to the customer's own bucket.
-- **tier\_down**: tag the pattern for a cheaper storage tier the destination enforces (Datadog Flex, CloudWatch IA, Azure Monitor Basic/Auxiliary).
+- **tier\_down**: tag the pattern for a cheaper tier the destination enforces (Datadog Flex, CloudWatch IA, Azure Monitor Basic/Auxiliary).
 - **offload**: route the pattern to customer-owned object storage (S3 or any S3-compatible store) instead of the destination.
 - **drop**: stop forwarding the pattern.
 

package/build/product-kb/docs/engine/launcher/extension.md

@@ -8,7 +8,7 @@ Extension runs the 10x Engine as its own [Lambda extension](https://docs.aws.ama
 
 ***Use-case***:
 
-Per-pattern regulation on serverless estates. A 100% Lambda shop has no node, no DaemonSet, and no forwarder host to install onto; the execution environment itself is the edge. The extension applies the same receive pipeline the [Receiver](https://doc.log10x.com/apps/receiver/) runs on Kubernetes: tag noisy patterns for cheaper storage tiers, offload slices to your own S3, and mute what nobody reads, before the first byte leaves the function.
+Per-pattern regulation on serverless estates. A 100% Lambda shop has no node, no DaemonSet, and no forwarder host to install onto; the execution environment itself is the edge. The extension applies the same receive pipeline the [Receiver](https://doc.log10x.com/apps/receiver/) runs on Kubernetes: tag noisy patterns for cheaper tiers, offload slices to your own S3, and mute what nobody reads, before the first byte leaves the function.
 
 ## :material-puzzle-outline: Benefits
 

package/build/product-kb/docs/faq/apps/receiver.md

@@ -23,7 +23,7 @@ The [Receiver](https://doc.log10x.com/apps/receiver/) is the execution arm of th
     - **pass**: forward unchanged.
     - **sample**: forward a rate-limited share against a per-pattern budget. Uses automatic [message enrichment](https://doc.log10x.com/run/initialize/message/){target="_blank"} to identify event types by their symbol identity and calculate ingestion cost per event (bytes × $/GB). When an event type exceeds its share of the budget, the Receiver samples it down, in real time at the source, before expensive data reaches your analyzer. A [severity floor](https://doc.log10x.com/run/receive/rate/){target="_blank"} keeps a minimum share of ERROR and WARN events flowing even when their pattern is over its cap.
     - **compact**: replace repeated lines with an encoded form the destination expands at query time, with no dashboard changes. Lossless only on Splunk (up to 256 KB per event) and self-hosted Elasticsearch/OpenSearch with the expand plugin installed ([Splunk](../../apps/receiver/compact/splunk.md), [Elasticsearch](../../apps/receiver/compact/elasticsearch.md)). It is a no-op on managed/SaaS destinations (Datadog, CloudWatch, Azure, GCP, Sumo, managed Elasticsearch).
-    - **tier_down**: tag the pattern for a cheaper storage tier the destination enforces (Datadog Flex, CloudWatch IA, Azure Monitor Basic/Auxiliary).
+    - **tier_down**: tag the pattern for a cheaper tier the destination enforces (Datadog Flex, CloudWatch IA, Azure Monitor Basic/Auxiliary).
     - **offload**: route the pattern to customer-owned object storage (S3 or any S3-compatible bucket) instead of the destination.
     - **drop**: stop forwarding the pattern.
 

package/build/product-kb/docs/faq/general.md

@@ -118,7 +118,7 @@ description: "What the 10x Engine does, the measured 63.7% lossless reduction on
     **Keeping every line.** Cribl only lowers the bill by dropping lines or rolling them into summaries, and both throw the original away. Keep every line intact and Cribl saves nothing, so you trade completeness against cost. 10x lowers the bill while keeping every line, and drops or samples only when you choose. For each pattern (one kind of log line, regardless of timestamps and IDs) it picks the cheapest way to keep the line, based on your log analyzer:
 
     - **Compact** (shrink the line in place): on Splunk (up to 256 KB per event) and self-hosted Elasticsearch/OpenSearch, 10x shrinks each line to a fraction of its size, and your analyzer still stores it, searches it, and shows the full original.
-    - **Tier down** (move it to a cheaper storage class): when your analyzer sells a lower-cost class you can still search, like Datadog Flex, CloudWatch Infrequent Access, or Azure Monitor Basic/Auxiliary Logs, 10x moves the line into it.
+    - **Tier down** (move it to a cheaper tier): when your analyzer sells a lower-cost class you can still search, like Datadog Flex, CloudWatch Infrequent Access, or Azure Monitor Basic/Auxiliary Logs, 10x moves the line into it.
     - **Offload** (park it in storage you own): with any analyzer, 10x sends the line to an S3 or S3-compatible bucket you own, and fetches the exact original back on demand with no restore step; lines loaded back into your log analyzer bill as ingest there. Azure Blob Storage is not an offload target.
 
     **Getting data back.** Cribl's only retrieval path is Replay, which reprocesses archived data and loads it back into your log analyzer, where it counts again as billable volume.
@@ -136,7 +136,7 @@ description: "What the 10x Engine does, the measured 63.7% lossless reduction on
     **Keeping every line.** Grepr samples the feed and replaces groups of lines with summaries, keeping the full lines only in its own data lake. 10x keeps every line, and drops or samples only when you choose. For each pattern it picks the cheapest way to keep the line, based on your log analyzer:
 
     - **Compact** (shrink the line in place): on Splunk (up to 256 KB per event) and self-hosted Elasticsearch/OpenSearch, 10x shrinks each line to a fraction of its size, and your analyzer still stores, searches, and shows the full original.
-    - **Tier down** (move it to a cheaper storage class): a class you can still search, like Datadog Flex, CloudWatch Infrequent Access, or Azure Monitor Basic/Auxiliary Logs.
+    - **Tier down** (move it to a cheaper tier): a class you can still search, like Datadog Flex, CloudWatch Infrequent Access, or Azure Monitor Basic/Auxiliary Logs.
     - **Offload** (park it in storage you own): with any analyzer, 10x sends the line to an S3 or S3-compatible bucket you own, and fetches the exact original back on demand with no restore step; lines loaded back into your log analyzer bill as ingest there. Azure Blob Storage is not an offload target.
 
     **Getting data back.** When you investigate an incident, Grepr copies the relevant full lines back into your log analyzer, which charges you to take in that volume a second time.
@@ -152,7 +152,7 @@ description: "What the 10x Engine does, the measured 63.7% lossless reduction on
     **Keeping every line.** Tero cuts log volume one way, by deleting lines before they reach your log analyzer, and what it deletes is gone. 10x keeps every line, and drops or samples only when you choose. Per line, only offload takes the line off the log analyzer's bill the way deleting it does; a compact or tiered-down line still bills at its smaller size or cheaper rate. For each pattern 10x picks the cheapest way to keep the line, based on your log analyzer:
 
     - **Compact** (shrink the line in place): on Splunk (up to 256 KB per event) and self-hosted Elasticsearch/OpenSearch, 10x shrinks each line to a fraction of its size, and your analyzer still stores, searches, and shows the full original.
-    - **Tier down** (move it to a cheaper storage class): a class you can still search, like Datadog Flex, CloudWatch Infrequent Access, or Azure Monitor Basic/Auxiliary Logs.
+    - **Tier down** (move it to a cheaper tier): a class you can still search, like Datadog Flex, CloudWatch Infrequent Access, or Azure Monitor Basic/Auxiliary Logs.
     - **Offload** (park it in storage you own): with any analyzer, 10x sends the line to an S3 or S3-compatible bucket you own, and fetches the exact original back on demand with no restore step; lines loaded back into your log analyzer bill as ingest there. Azure Blob Storage is not an offload target.
 
     **No way back with Tero.** Tero keeps no copy, so nothing it deletes can be recovered.

package/build/product-kb/docs/faq/stacks/datadog/comparisons.md

@@ -14,17 +14,19 @@ How 10x uses Datadog Flex Logs to cut the bill, how it compares to Log Rehydrati
     **How Flex pricing works**
 
     - **$0.10/GB ingestion**: charged on all data regardless of tier; tier_down does not change this meter
-    - **Standard indexing (per million events)**: the dominant charge that Flex Logs replaces on the down-tiered slice
+    - **$1.70/million events**: Standard indexing at 15-day retention (annual; $2.55 on-demand), the dominant charge that Flex Logs replaces on the down-tiered slice
     - **$0.05/million events**: Flex storage (annual commit; $0.075 on-demand)
     - **$0.60/million events**: Flex Starter with compute bundled (annual; $0.90 on-demand)
     - Compute is sold as flat-rate tiers (Starter, XS, S, M, L), each roughly twice the capacity of the previous; the larger tiers add a large compute charge
     - Monitors and Watchdog are not supported on Flex Logs. To alert on that data, keep a subset in a Standard index
 
+    **What a 10x plan reports for a Flex move:** Flex is the first lever the MCP plans on Datadog, ahead of offload, because the moved logs stay searchable in Datadog. The plan states the events and GB moved out of the Standard index, the Standard indexing line that move avoids at Datadog list, and the Flex storage line it adds at list (held 30 days unless a retention is set), and names Flex compute as unpriced and excluded from both figures. It states no percentage of the Datadog bill: compute is sized and quoted per account, so the net rests on a figure only Datadog can give. On Flex Starter, the bundled rate replaces the storage and compute lines.
+
     **Honest caveat:** Flex Logs must be enabled on the account first (pick a Compute size on the Flex Logs page, or the index apply is rejected). Lead with Flex Starter; the larger compute tiers add a large compute charge on top of storage.
 
     **For patterns you want out of Datadog entirely:** [Retriever](https://doc.log10x.com/apps/retriever/) offloads them to your own S3 at $0.023/GB-month, queries in-place via Bloom filter indexes, and streams specific time ranges and log types back on-demand, paying Datadog ingestion only on what you fetch. Or aggregate high-volume repetitive S3 events into metric data points on Datadog's time-series API, for dashboard visibility at metric pricing.
 
-    *[Datadog pricing](https://www.datadoghq.com/pricing/){target="_blank"} as of Jan 2026*
+    *[Datadog pricing](https://www.datadoghq.com/pricing/){target="_blank"} as of Jan 2026; Standard indexing, Flex storage and Flex Starter re-read 2026-09-30*
 
 ??? tenx-compare "How 10x compares to Datadog Log Rehydration"
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log10x-mcp",
-  "version": "1.30.35",
+  "version": "1.30.36",
   "description": "Rank log patterns by cost, then compact, tier down or offload them. No log data reaches log10x.",
   "mcpName": "io.github.log-10x/log10x-mcp",
   "type": "module",
@@ -63,9 +63,9 @@
     "@google-cloud/secret-manager": "^6.1.3",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "@opentelemetry/api": "^1.9.1",
-    "@opentelemetry/exporter-trace-otlp-http": "^0.218.0",
-    "@opentelemetry/resources": "^2.7.1",
-    "@opentelemetry/sdk-node": "^0.218.0",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.222.0",
+    "@opentelemetry/resources": "^2.11.0",
+    "@opentelemetry/sdk-node": "^0.222.0",
     "@opentelemetry/semantic-conventions": "^1.41.1",
     "@smithy/protocol-http": "^5.3.14",
     "@smithy/signature-v4": "^5.4.6",