---
title: "Services"
description: "Every tracked service, ranked by cost, with per-service volume and share of total."
icon: material/format-list-numbered
---

Rank every tracked service by cost when you need to know which services are driving the bill.

Returns a ranked list with per-service volume, dollar share of total, and a `Top-N = X% of volume` coverage line so you can tell whether a drill-down on the top few captures the question.

## :material-code-braces: Example

!!! tenx-ask "You"

    rank services by cost, 7d

!!! tenx-answer "Log10x"

    4 services account for 80% of $60K/wk: payments-svc $24K · cart-svc $18K · checkout-svc $11K · ad-svc $7K. 11 more below 5%. Top 3 services = 88% of volume.

## :material-chat-question-outline: More to ask

- *"top services by volume, 30d"*
- *"services we're monitoring"*
- *"services in `staging` env, last hour"*

## :material-check-decagram-outline: Prerequisites

This tool requires the [Reporter](../../../reporter/) deployed.

## :material-code-json: Schema and samples

??? tenx-input-example "Input example"

    Real call against the demo env (captured by [`scripts/capture-tool-envelopes.mjs`](https://github.com/log-10x/log10x-mcp/blob/main/scripts/capture-tool-envelopes.mjs)).

    ```json
    {
      "limit": 5,
      "timeRange": "7d",
      "view": "summary"
    }
    ```

??? tenx-input-schema "Input schema"

    Agent-facing JSON Schema (the canonical shape the MCP server publishes via `tools/list`):

    ```json
    {
      "type": "object",
      "properties": {
        "timeRange": {
          "type": "string",
          "enum": [
            "15m",
            "1h",
            "6h",
            "24h",
            "1d",
            "7d",
            "30d"
          ],
          "default": "7d",
          "description": "Time range. Sub-day values available for incident-window service ranking. '24h' and '1d' are equivalent."
        },
        "monthly_volume_gb": {
          "type": "number",
          "exclusiveMinimum": 0,
          "description": "What-if volume lens: model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. Real per-pattern shares and the pattern mix are held fixed; only absolute bytes and dollars scale, by one uniform factor. The envelope stamps volume_actual_gb vs volume_projected_gb and the scale factor; a [Projected to X/mo] prefix marks a lensed run. Omit it for the environment's real measured volume."
        },
        "analyzerCost": {
          "type": "number",
          "description": "SIEM ingestion cost in $/GB"
        },
        "environment": {
          "type": "string",
          "description": "Environment nickname"
        },
        "exception_services": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "maxItems": 50,
          "description": "Customer-flagged services that must stay in the SIEM with full retention (audit / regulatory / executive). Per row, marks current_mode=\"pass\" and points next_action at pattern_mitigate instead of the configure_engine bulk path."
        },
        "view": {
          "type": "string",
          "const": "summary",
          "default": "summary",
          "description": "Output format. Always \"summary\", the typed envelope (data.services[], data.totals). Field retained for backward-compat."
        }
      },
      "additionalProperties": false
    }
    ```

    Source: [`src/tools/services.ts`](https://github.com/log-10x/log10x-mcp/blob/main/src/tools/services.ts).

??? tenx-output-example "Output example"

    Real envelope from the demo env. `view: "summary"` returns the full `StructuredOutput` with typed `data`. Long arrays + base64 PNG bodies trimmed for readability; the real call returns them in full.

    Headline (the 1-line agent-facing answer):

    > _28 services over this week: opentelemetry-collector leads at $50/wk (72% of total $69/wk)._

    ```json
    {
      "schema_version": "1.0",
      "schema_epoch": "2026-05-25",
      "tool": "log10x_services",
      "generated_at": "2026-05-26T15:37:07.804Z",
      "view": "summary",
      "summary": {
        "headline": "28 services over this week: opentelemetry-collector leads at $50/wk (72% of total $69/wk)."
      },
      "data": {
        "time_range": "this week",
        "cost_per_gb": 1.5,
        "period": "/wk",
        "total_bytes": 49585873423.42819,
        "total_cost": 69.27066495189656,
        "service_count": 28,
        "top_n_share_pct": 88,
        "services": [
          {
            "rank": 1,
            "name": "opentelemetry-collector",
            "bytes": 35829123334.79456,
            "cost": 50.05270708556459,
            "pct": 72.2567151915209
          },
          {
            "rank": 2,
            "name": "payment",
            "bytes": 6550557827.022675,
            "cost": 9.151023570945497,
            "pct": 13.210532304403626
          },
          {
            "rank": 3,
            "name": "cart",
            "bytes": 1495589805.8115377,
            "cost": 2.0893148227755973,
            "pct": 3.016161060712315
          },
          "... 25 more elided"
        ]
      },
      "actions": [
        {
          "tool": "log10x_top_patterns",
          "args": {
            "service": "opentelemetry-collector"
          },
          "reason": "current top patterns for the highest-cost service"
        },
        {
          "tool": "log10x_investigate",
          "args": {
            "starting_point": "opentelemetry-collector"
          },
          "reason": "causal-chain analysis on the top service"
        }
      ],
      "truncated": false,
      "warnings": []
    }
    ```

??? tenx-output-schema "Output schema"

    The `data` block inside the [StructuredOutput envelope](../index.md#json-by-default-output):

    ```typescript
    interface ToolData {
      time_range: string;
      cost_per_gb: number;
      period: string;
      total_bytes: number;
      total_cost: number;
      service_count: number;
      top_n_share_pct: number;
      services: Array<{
        rank: number;
        name: string;
        bytes: number;
        cost: number;
        pct: number;
      }>;
    }
    ```

    Envelope-level fields the agent should also read: `summary.headline` (1-line answer), `actions[]` (next-call chain hints as `{tool, args, reason}`), `truncated: boolean`, `images[]` (PNG attachments where applicable), `schema_epoch` (engine-ID stability boundary).