---
title: "Mitigate"
description: "One menu of every way to reduce a noisy pattern's cost (compact, sample, drop, mute) gated by what's actually deployed."
icon: material/playlist-check
---

Ask once, get every viable option. The tool checks what's deployed in the active env (Receiver? Retriever? GitOps wiring? Which forwarder and analyzer?) and renders a menu of mitigation paths with the unavailable ones dimmed, so you never pick a path that needs infrastructure you don't have.

Each option emits a structured next-action so the agent can route on your choice in one hop.

The four options:

| Option | What it does | How to apply |
|---|---|---|
| Drop at the analyzer | Vendor-native exclusion (Datadog / Splunk / CloudWatch / Elasticsearch). Pattern is dropped at ingest. | Paste the per-option `config_snippet` into your analyzer. |
| Drop at the forwarder | Forwarder-side filter (fluent-bit, fluentd, otel-collector, etc.). Pattern is dropped before it leaves the host. | Paste the per-option `config_snippet` into your forwarder config. |
| Cap at the Receiver | Per-container byte cap via the [rate regulator](../../../receiver/rate/). PR against the gitops repo. | [Engine PR](../install/configure-engine.md) |
| Compact at the Receiver | Lossless volume reduction via [Compact mode](../../../receiver/compact/) on Splunk and self-hosted Elasticsearch, the destinations whose expander reads the compact form back. PR against the gitops repo. | [Engine PR](../install/configure-engine.md) |

[Dependency check](dependency-check.md) is listed as a required pre-action for any drop-style option, so the safety gate stays enforced.

## :material-code-braces: Example

!!! tenx-ask "You"

    options for `Payment_Gateway_Timeout`, it's $58/mo

!!! tenx-answer "Log10x"

    Receiver deployed (gitops: `acme/log10x-config`). Forwarder: `fluentbit`. Analyzer: Datadog.

    1. **Drop at Datadog**: `@tenx_hash:"sZw4qq3MCWE"` exclusion filter. Stops appearing in Logs Explorer. _Run [Dependency check](dependency-check.md) first._
    2. **Drop at fluent-bit**: drop rule on the forwarder; pattern never reaches Datadog. _Run [Dependency check](dependency-check.md) first._
    3. **Cap at the Receiver**: per-container byte cap with PR against `acme/log10x-config`. Pattern is sampled at the severity floor when it goes hot.
    4. **Compact at the Receiver**: losslessly compact the pattern's container (Splunk, self-hosted Elasticsearch) with full retriever expansion.

    Which?

## :material-chat-question-outline: More to ask

- *"options for `HealthCheck_Pass`, just the cheapest"*
- *"only mute/compact options, skip the analyzer drops"*

## :material-check-decagram-outline: Prerequisites

None. The tool degrades gracefully.

Without a snapshot, it still renders the menu but dims PR-based options when no `gitops.repo` is set on the active env. With a [snapshot](../install/discover-env.md), the dim/highlight is based on what's actually deployed.

## :material-code-json: Schema and samples

??? tenx-input-example "Input example"

    Real call against the demo env (captured by [`scripts/capture-tool-envelopes.mjs`](https://github.com/log-10x/log10x-mcp/blob/main/scripts/capture-tool-envelopes.mjs)).

    ```json
    {
      "pattern": "cart_cartstore_ValkeyCartStore",
      "view": "summary"
    }
    ```

??? tenx-input-schema "Input schema"

    Agent-facing JSON Schema (the canonical shape the MCP server publishes via `tools/list`):

    ```json
    {
      "type": "object",
      "properties": {
        "pattern": {
          "type": "string",
          "minLength": 1,
          "description": "The pattern identity to mitigate. Pass the canonical name from a prior log10x_top_patterns / log10x_cost_drivers / log10x_event_lookup row."
        },
        "service": {
          "type": "string",
          "description": "Optional service scope. When set, options that target a single service (forwarder drop, exclusion filter) are scoped to it."
        },
        "snapshot_id": {
          "type": "string",
          "description": "Snapshot from log10x_discover_env. Used to detect which 10x components are deployed in the active env (receiver, retriever, GitOps wiring). When passed, the envelope's `recommendation_audit.capability_sources` reflects which capabilities came from the snapshot vs envs.json. Without it, the tool still works but may dim PR-based options if the active env's envs.json does not list a gitops repo."
        }
      },
      "required": [
        "pattern"
      ],
      "additionalProperties": false
    }
    ```

    Source: [`src/tools/pattern-mitigate.ts`](https://github.com/log-10x/log10x-mcp/blob/main/src/tools/pattern-mitigate.ts).

??? tenx-output-example "Output example"

    Real envelope from the demo env. `view: "summary"` returns the full `StructuredOutput` with typed `data`. Long arrays + base64 PNG bodies trimmed for readability; the real call returns them in full.

    Headline (the 1-line agent-facing answer):

    > _`cart\_cartstore\_ValkeyCartStore`: 1 of 4 mitigation options enabled (drop\_at\_analyzer)_

    ```json
    {
      "schema_version": "1.0",
      "schema_epoch": "2026-05-25",
      "tool": "log10x_pattern_mitigate",
      "generated_at": "2026-05-26T15:38:35.771Z",
      "view": "summary",
      "summary": {
        "headline": "`cart_cartstore_ValkeyCartStore`: 1 of 4 mitigation options enabled (drop_at_analyzer)"
      },
      "data": {
        "pattern": "cart_cartstore_ValkeyCartStore",
        "options": [
          {
            "id": "drop_at_analyzer",
            "enabled": true,
            "label": "Drop at Splunk"
          },
          {
            "id": "drop_at_forwarder",
            "enabled": false,
            "disabled_reason": "forwarder not detected from env / snapshot",
            "label": "Drop at forwarder"
          },
          {
            "id": "mute_at_10x",
            "enabled": false,
            "disabled_reason": "To enable mute/compact at the 10x engine, set `gitops.repo` (owner/name) in your `~/.log10x/envs.json` entry, or export `LOG10X_GH_REPO=<owner/name>`, or pass a `snapshot_id` from `log10x_discover_env` against a cluster with a receiver pod that has `GH_ENABLED=true` + `GH_REPO=<owner/name>` set.",
            "label": "Mute at 10x receiver"
          },
          "... 1 more elided"
        ],
        "env_capabilities": {
          "can_mute": false,
          "can_compact": false,
          "has_retriever_archive": false,
          "analyzer_vendor": "splunk"
        }
      },
      "actions": [],
      "truncated": false,
      "warnings": []
    }
    ```

??? tenx-output-schema "Output schema"

    The `data` block inside the [StructuredOutput envelope](../index.md#json-by-default-output):

    ```typescript
    interface ToolData {
      pattern: string;
      options: Array<{
        id: string;
        enabled: boolean;
        label: string;
      }>;
      env_capabilities: { can_mute: boolean; can_compact: boolean; has_retriever_archive: boolean; analyzer_vendor: string };
    }
    ```

    Envelope-level fields the agent should also read: `summary.headline` (1-line answer), `actions[]` (next-call chain hints as `{tool, args, reason}`), `truncated: boolean`, `images[]` (PNG attachments where applicable), `schema_epoch` (engine-ID stability boundary).