---
icon: material/check-circle-outline
title: "Compatibility"
---

What changes in Datadog and on the forwarder, which forwarders 10x supports, how it works with Log Pipelines, how to measure it on a day of the account's own logs, what the first four weeks look like, and how to roll back.

### :material-check-circle-outline: Compatibility

??? tenx-compat "What changes in Datadog and on the forwarder"

    **In Datadog, one change, and only for tier_down, the action that sends a pattern's excess to Flex Logs:** a Flex Logs index whose filter is `@routeState:tier_down`, listed before the Standard index, with Flex Logs enabled on the account. Log Pipelines stay as they are, and dashboards, monitors and saved views keep working on the events left in the Standard index. The moved slice stays searchable in Log Explorer with **Include Flex Logs** on, log-based metrics and Live Tail still see it, and it pays ingestion. Datadog runs no monitors on [Flex Logs](https://docs.datadoghq.com/logs/log_configuration/flex_logs/){target="_blank"}, so keep every pattern a monitor reads in Standard.

    **On the forwarder, one of two:** with Fluent Bit or Fluentd, the Receiver runs as a sidecar in the forwarder pod; the forwarder's pipeline gains a handoff to the sidecar and its Datadog output stays as it was. With the Datadog Agent, the Agent's `logs_config` points at the folder the Receiver writes instead of the application's own log folder. Both paths are on the [Integration](integration.md) page.

    The [MCP server](https://github.com/log-10x/log10x-mcp){target="_blank"} drives the rest from an AI client: a read-only pass over Datadog's API, a per-pattern plan, and the engine config written as Helm values or a GitOps pull request for review. The MCP server's only output is that config; the team makes every change to the cluster and the Datadog org, applying the Helm values or merging the pull request.

    The components it configures:

    - **[Receiver](https://doc.log10x.com/apps/receiver/)** (sidecar to the forwarder): caps each pattern and applies the service's action to the excess: tier_down to a Flex Logs index, offload to S3, or drop. Compact, the lossless volume reduction, applies to the S3 offload path; what Datadog indexes keeps its original structure.
    - **[Reporter](https://doc.log10x.com/apps/reporter/)** (DaemonSet): per-pattern cost before logs reach Datadog, read from the stream while the forwarder delivers every log itself.
    - **[Retriever](https://doc.log10x.com/apps/retriever/)**: reads offloaded events back from S3.

??? tenx-compat "What log forwarders does log10x support"

    **The major log forwarders.**

    **Native plugin integrations:**

    - [Fluent Bit](https://doc.log10x.com/run/input/forwarder/fluentbit/){target="_blank"} / [Fluentd](https://doc.log10x.com/run/input/forwarder/fluentd/){target="_blank"}
    - [Filebeat](https://doc.log10x.com/run/input/forwarder/filebeat/){target="_blank"} / [Logstash](https://doc.log10x.com/run/input/forwarder/logstash/){target="_blank"}
    - [OpenTelemetry Collector](https://doc.log10x.com/run/input/forwarder/otel-collector/){target="_blank"} / [Vector](https://doc.log10x.com/run/input/forwarder/vector/){target="_blank"}

    **File relay integrations:**

    - [Datadog Agent](https://doc.log10x.com/run/input/forwarder/datadogAgent/){target="_blank"}
    - [Splunk UF](https://doc.log10x.com/run/input/forwarder/splunkUF/){target="_blank"}

    **Deployment:** the AI agent, through the MCP server, scans the environment and generates the wiring. The Reporter deploys as a DaemonSet beside the existing forwarders; the Receiver deploys as a sidecar to them.

??? tenx-compat "How does this work with Datadog Log Pipelines"

    **Log Pipelines run as before.** The Receiver acts before logs reach Datadog. Every event it forwards keeps its original structure and gains `routeState`, which the Flex index filter reads, and `tenx_hash`, the pattern hash for reports and lookups, which the MCP's install recipes add by setting `symbolMessageHashField`. Grok parsers, remappers, category processors and the other pipeline processors read the events as they did.

### :material-rocket-launch-outline: Getting Started

??? tenx-start "How do I measure it on a day of my own logs"

    **The test is a day of the account's own logs, with Datadog's own filters as the control.** The [MCP server](https://doc.log10x.com/install/#get-started), installed into an AI client (Claude, Cursor, and others), runs steps 3 and 4; the engine runs on the local machine and the logs stay there.

    1. **Baseline one weekday in Datadog.** Query `datadog.estimated_usage.logs.ingested_events` and `datadog.estimated_usage.logs.ingested_bytes`, grouped by `datadog_index`, `datadog_is_excluded` and `service` ([usage metrics](https://docs.datadoghq.com/account_management/billing/usage_metrics/){target="_blank"}). Datadog notes the estimate can differ from the bill, so reconcile it against Plan and Usage.
    2. **Take that day's logs.** Both the Datadog archive and raw forwarder output from representative nodes hold them, excluded logs included. A [cost POC on Datadog](https://doc.log10x.com/apps/mcp/tools/poc/) over the API is quicker but sees only what Datadog indexed, as a sample.
    3. **Run the [local POC](https://doc.log10x.com/apps/mcp/tools/poc/poc-from-local/) on that file.** The report sets two arms side by side on the same events, counted in Datadog's unit: the per-pattern plan, and the index filters a person writes without 10x, one per service with `-status:(emergency OR alert OR critical OR error OR warn)`, split by `logger.name` where Datadog's pipeline parses it, largest first until they reach the events the plan moves. The difference between the arms, priced at the contract rate, is what 10x adds; if it does not clear the licence, the filters are the answer.
    4. **Check what a move would blind.** Before a rule moves source statements, the logging calls patterns come from, off Standard, the plan lists the log monitors and log-based metrics whose queries read them. Datadog runs no monitors on Flex Logs.
    5. **Canary a node group for a week.** Deploy the [Receiver](https://doc.log10x.com/apps/receiver/deploy/) with the values the plan writes (the built-in Free tier covers up to 10 nodes), with a Flex Logs index on `@routeState:tier_down` ahead of Standard, and compare indexed events per index against matched control nodes.
    6. **Read the week.** The weekly change report lists the statements new in each service, what each costs in Standard and the rule that held it, if one did.

    The [Retriever](https://doc.log10x.com/apps/retriever/) fetches offloaded events back from S3 on demand. Moving the Flex index behind the Standard index or removing the sidecar undoes the canary; see rollback below.

??? tenx-start "Can I see which log types are costing the most"

    **Yes, ask the agent.** Through the [MCP server](https://github.com/log-10x/log10x-mcp){target="_blank"}, ask what drives the Datadog cost. The answer comes from a read-only pass over the Datadog logs API, with patterns, services and sources ranked by volume and cost.

    For continuous visibility before ingestion, deploy the [Reporter](https://doc.log10x.com/apps/reporter/) DaemonSet. Either way the breakdown is by service, source, log level and custom dimensions.

??? tenx-start "What happens in the first four weeks"

    - **Day 1:** ask the AI agent for a cost POC on Datadog over the API, or deploy the [Reporter](https://doc.log10x.com/apps/reporter/) for per-pattern cost before logs reach Datadog.
    - **Week 1 to 2:** have the agent write the [Receiver](https://doc.log10x.com/apps/receiver/) deployment (Helm values or a GitOps pull request to approve), with the Flex index in front of Standard.
    - **Week 3 to 4:** read the move in Datadog's **Log Management - Estimated Usage** dashboard: events in Standard against events in Flex. Whether the Flex line nets below the Standard line it replaces depends on the Standard retention and on the Flex tier the volume falls in; [benchmarks/datadog-flex-accounting](https://github.com/log-10x/benchmarks/tree/main/datadog-flex-accounting){target="_blank"} works it through at list price. Offload removes its slice from Datadog entirely. Compact reduces S3 storage, not the Datadog bill.

??? tenx-start "Is the deployment reversible"

    **Yes.** Rolling back takes minutes:

    - **Remove the Receiver sidecar** (or revert the GitOps pull request the AI agent opened) and roll the forwarder pods. The Receiver is fail-open: once the sidecar stops, the forwarder ships at full volume.
    - **On the Datadog Agent path,** point `logs_config` back at the application's own log folder.
    - **The Flex index stays** until the team deletes it; the other indexes and pipelines are untouched.

    Datadog pipelines and existing dashboards stay as they are. In the organization 10x adds the Flex index above, from the Terraform the install plan prints, and the [Datadog Agent check](https://doc.log10x.com/install/datadog/), which submits the per-pattern counters, brings a dashboard and two monitor templates to import. The Receiver sidecar acts before events reach Datadog; the Reporter DaemonSet reads the stream while the forwarder delivers every log itself. The MCP tools read over the API or from S3, the hourly budget run against Datadog's usage metric writes the policy the Receiver reads, and every other change is proposed for review.