--- title: "Receiver" description: "act on each log pattern before it ships to output: pass, sample, compact, tier_down, offload or drop; compact is lossless on Splunk (up to 256 KB per event) and self-hosted Elasticsearch 8.17.0 or OpenSearch 2.19.0" source: "https://github.com/log-10x/modules/tree/main/apps/receiver/app.yaml" icon: "material/pipe-valve" --- The Receiver runs with the forwarder, as a sidecar container, embedded in it or as a file relay depending on the forwarder, and acts on each log pattern before events reach your analyzer. A pattern is the set of events one log statement writes, whatever IDs or timestamps they carry. Its actions are **pass, sample, compact, tier_down, offload, and drop**. The action is set per service and applies to the lines each pattern in that service sends over its cap, a limit per pattern per time window. An AI agent sets the action per service through the [log10x MCP](https://doc.log10x.com/apps/mcp/) (`configure_engine`) as a config change in the [GitOps](https://doc.log10x.com/engine/gitops/) repo, and the engine enforces it. ## :material-cog-transfer-outline: Workflow The Receiver app processes events from a variety of [log forwarders](https://doc.log10x.com/run/input/forwarder), such as Fluentd, Fluent Bit, Filebeat, and Logstash. Configure the app to process all or a subset of the events, allowing for targeted analysis and per-pattern actions.
```mermaid graph LR A["
🚙 Forwarder
Sidecar Process
"] --> B["
📡 Receive
Stream Events
"] B --> C["
🔄 Transform
into TenXObjects
"] C --> D["
🎁 Enrich
Add Context
"] D --> E["
🚦 Act
Per-Pattern Action
"] E --> F["
📤 Output
Write to Forwarder
"] classDef deploy fill:#7c3aed88,stroke:#6d28d9,color:#ffffff,stroke-width:2px,rx:8,ry:8 classDef receive fill:#9333ea88,stroke:#7c3aed,color:#ffffff,stroke-width:2px,rx:8,ry:8 classDef transform fill:#2563eb88,stroke:#1d4ed8,color:#ffffff,stroke-width:2px,rx:8,ry:8 classDef enrich fill:#059669,stroke:#047857,color:#ffffff,stroke-width:2px,rx:8,ry:8 classDef regulate fill:#dc2626,stroke:#b91c1c,color:#ffffff,stroke-width:2px,rx:8,ry:8 classDef output fill:#ea580c88,stroke:#c2410c,color:#ffffff,stroke-width:2px,rx:8,ry:8 class A deploy class B receive class C transform class D enrich class E regulate class F output ```
🚙 **Forwarder**: Runs the 10x engine with the log forwarder, as a [sidecar container](https://doc.log10x.com/engine/launcher/sidecar) (Fluentd, Fluent Bit, Logstash, OTel Collector, Vector), embedded in it (Filebeat) or as a file relay (Splunk Universal Forwarder, Datadog Agent), for real-time event analysis 📡 **Receive**: Read events continuously from [log forwarders](https://doc.log10x.com/run/input/forwarder) via IPC 🔄 **Transform**: Structures log events into well-defined [TenXObjects](https://doc.log10x.com/run/transform/) 🎁 **Enrich**: Applies [enrichment rules](https://doc.log10x.com/run/initialize/) to augment TenXObjects with intelligent context 📈 **Report**: Publishes [cost insight metrics](https://doc.log10x.com/run/output/metric "Time-series outputs provide an extensible method for publishing TenXSummary instances") for visualization and alerting 🚦 **Act**: Apply the per-pattern action: pass, [sample](https://doc.log10x.com/run/receive/rate/) against a per-node budget, [compact](compact/index.md) for search-time expansion on Splunk and self-hosted Elasticsearch 8.17.0 or OpenSearch 2.19.0, tier_down, offload to customer-owned object storage, or drop 📤 **Output**: Writes processed events back to forwarder to ship to destination analyzers ## :material-hexagon-multiple-outline: Architecture The Receiver runs with the forwarder, as a [sidecar](https://doc.log10x.com/engine/launcher/sidecar), embedded in it or as a file relay depending on the forwarder, and applies a per-pattern action (pass, sample, compact, tier_down, offload, drop) *before* events ship to a log analyzer. An AI agent picks the action per service through the log10x MCP `configure_engine` tool; the decision is delivered as a config change through the GitOps repo. === ":material-car-speed-limiter: Per-Pattern Cap" The regulator caps what each [pattern](https://doc.log10x.com/run/initialize/message/) may spend in its container over a window (default 4 minutes), counted in bytes, or in events when the regulator's `unit` is set to events (a multi-line event counts as one). Over the cap, keep counts pass up to 50 ERROR, CRITICAL and FATAL lines per pattern per window as shipped, severity floors keep a set share of the other levels (0 as shipped), and the rest takes the container's action, pass when none is set. Each Receiver counts and enforces its caps on its own node. See the [rate regulator](https://doc.log10x.com/run/receive/rate/).
![Architecture diagram: Receiver sidecar applies per-event-type rate limits to filter noisy events before forwarding to log analyzers](../../assets/tenx-edge-receiver.svg){ align=left }
:white_check_mark: **Receivers** cap each pattern's bytes per container to prevent over-billing.
=== ":material-file-document-edit-outline: Mute File (GitOps)" A declarative file keyed by the joined `rateReceiverFieldNames` values (e.g. `message_pattern`, `container`) caps specific patterns with an explicit sample rate and expiry. Operators (or an AI assistant via the [Log10x MCP](https://github.com/log-10x/log10x-mcp)) append entries based on [Reporter](https://doc.log10x.com/apps/reporter/) cost attribution, commit to git, and every receiver pulls the file on its next reload. Each mute is diff-reviewed, self-expires, and maps 1:1 to the field-sets the Reporter attributes cost to. See [mute file mode](https://doc.log10x.com/run/receive/rate/#protection-list). ## :material-shield-check-outline: Safety & Reliability With sidecar forwarders (Fluentd, Fluent Bit, Logstash, OTel Collector, Vector) the Receiver is a separate container next to the forwarder. If it stops, Kubernetes restarts it; in between, the forwarder buffers events up to its own buffer and retry limits, then reconnects. With Filebeat, 10x runs inside the forwarder's own container, so the two share one lifecycle and restart together. On the OpenTelemetry Collector route the Receiver acknowledges an export once its lines have been sent on and accepted, so the collector resends what was in flight through a Receiver restart and every line arrives, some twice ([custody run](https://github.com/log-10x/benchmarks/tree/main/clickstack-e2e-gaps){target="_blank"}). |Topic|Detail| |---|---| |[Restart](faq.md#what-happens-if-the-sidecar-fails)|Kubernetes restarts the 10x container; in between, the forwarder buffers events up to its own buffer limit. With 10x embedded in Filebeat, the two restart together| |[Backpressure handling](faq.md#how-does-the-receiver-handle-failures)|Under backpressure the forwarder slows down and buffers spikes to disk until the Receiver catches up| |[Resource requirements](faq.md#which-log-forwarders-does-the-receiver-support)|A heap set explicitly, for example 512m in a 768Mi container limit| |[Rollback](faq.md#what-happens-if-the-sidecar-fails)|`helm uninstall` removes the 10x container in about a minute| See the [Receiver FAQ](faq.md) for failure handling, resource settings, and deployment.