Skip to content

Commercial Plan Billing Logic

This document presents the billing framework for the pay-as-you-go Commercial Plan of the TrueWatch product, detailing the conditions under which each billing item is generated and the logic for calculating prices.

Concepts

Term Description
Data Storage Customizes the data retention period for different data types
Basic Billing The unit price of a billing item is a fixed value
Tiered Billing The unit price of a billing item is a dynamic value, which varies based on the data storage strategy selected for the current data type

Billing Cycle

The billing cycle is calculated daily: The workspace usage for each day is settled at midnight the following day, and the daily bill is synchronized to the Billing Center. Finally, the system will deduct the corresponding consumption amount from the appropriate account based on the chosen settlement method.

Billing Items

Time Series

Counts the number of tag combinations for each metric reported by DataKit on the day (billed per thousand, unit: "thousand/day").

For more details, refer to Time Series Logic Explained.

Logs

Billed by Data Count

Data generated by functions such as logs, events, Security Check, and Synthetic Tests (per million /day):

  • If the "Custom Multiple Indices" feature is enabled for logs, the daily data increment is counted based on different indices, and the actual cost is calculated based on the unit price of the corresponding data storage strategy.
  • Events include those generated by monitoring module configurations (monitors, SLO), Intelligent Inspection reported events, and user-defined reported events.
  • Synthetic Tests data reported by self-built testing nodes.
  • The costs for events, Security Check, and Synthetic Tests data default to the unit price corresponding to the "default" index of logs.
Warning

Depending on the selected storage type, oversized log data will be split into multiple entries for billing:

  • ES Storage: If the log size exceeds 10 KB, the number of billing entries = round up (log size / 10 KB)

  • SLS Storage: If the log size exceeds 2 KB, the number of billing entries = round up (log size / 2 KB)

If a single piece of data is below the above limits, it is still counted as 1 entry.

Billed by Ingested Log Volume

The size of the original log data volume reported by users (per GB /day).

Warning

Log data is billed by count by default. To switch to billing by ingested volume, please contact your account manager.

Data Forwarding

External Storage Forwarding Volume Statistics

Based on the different external storage types in the current workspace, the forwarded data volume is aggregated. Daily incremental data is counted and billed based on the data volume (unit: per GB/day).

Internal Storage Forwarding Volume Statistics

Based on the data forwarded to TrueWatch internal storage, the forwarded data volume is aggregated. Full data is counted and billed based on the data volume (unit: per GB/day).

Sensitive Data Scanning Volume

Based on scanning rules, the original data volume of scanned sensitive data is counted (per GB /day).

For example: If log data A needs to be scanned, and three fields within the data require desensitization rule processing, the desensitization scanning for these three fields will be billed separately.

Network

The number of hosts reporting network data in the workspace via eBPF (per host reporting network data /day).

APM Traces

Counts the number of Traces in the reported trace data. Generally, if the trace_id in the Span data is the same, these Spans are grouped under one Trace (per million Traces /day).

Warning

In the latest billing adjustment of TrueWatch, the larger value between "count/10" and the number of trace_id will be taken as the daily billing data.

APM Profiles

Counts the number of APM Profile data reported (per ten thousand Profiles /day).

Billing Notes

Profile data mainly consists of two parts: basic attribute data + Profile analysis files

  • If the Profile analysis file size exceeds 300 KB, the data will be split into multiple entries for billing

  • Billing entry count formula: round up (Profile analysis file size / 300 KB)

  • If the analysis file is less than 300 KB, it is counted as 1 entry.

RUM PV

Counts the number of page views reported by users, generally derived from the daily count of Resource, Long Task, Error, and Action data (per ten thousand PVs /day).

Warning

In the latest billing adjustment of TrueWatch, the larger value between "count/100" and the PV count will be taken as the daily billing data.

Whether it's an SPA (Single Page Application) or MPA (Multi-Page Application), each user visit to a page (including refresh or re-entry) counts as 1 PV.

Session Replay

Counts the number of Sessions with actual session replay data. Generally, it is derived by counting the number of session_id with has_replay:true in the Session data (per thousand Sessions /day).

Billing Notes

  • If there are excessively long active Sessions, the Session will be split into multiple entries for billing based on time_spent.

  • If Session time_spent > 4 hours, billing count = round up (time_spent / 4 hours);

  • If Session time_spent is less than the above 4 hours, it is still counted as 1 Session.

Synthetic Tests

Enables Synthetic Tests tasks and returns test results via the testing nodes provided by TrueWatch. The number of new test data is counted hourly (per ten thousand API Tests /day).

Warning

Since the current Synthetic Tests data is stored in the default index of logs, DQL queries or statistics need to add the following filter conditions to query Synthetic Tests data.

index = ['default'], source = [‘http_dial_testing',‘tcp_dial_testing’,'icmp_dial_testing','websocket_dial_testing']

Triggers

Costs generated by using anomaly detection, metric generation, and other functions (per ten thousand /day).

  • Enables monitors, SLO, and other scheduled detection tasks. Among them, mutation detection, range detection, outlier detection, and log detection count as 5 trigger calls per detection, while other detection types count as 1 trigger call. Additionally, if the detection interval exceeds 15 minutes, the excess part is counted as 1 trigger call per 15 minutes;

  • Intelligent Monitoring: Host, log, and application intelligent detection count as 10 trigger calls per execution; user access intelligent detection counts as 100 trigger calls per execution;

  • DataKit/OpenAPI queries count as 1 trigger call per query;

  • Enabling metric generation counts as 1 trigger call per query;

  • Using advanced functions provided by the central Func counts as 1 trigger call per query.

Calculation Example

Monitor Trigger Counts:

  1. Normal calculation example: Assuming one "Mutation Detection" is executed, it counts as 5 trigger calls.
  2. Calculation example with exceeded detection interval: If the detection interval is 30 minutes, the excess part is counted as 1 trigger call per 15 minutes. For example, executing one "Outlier Detection" counts as 6 trigger calls.
  3. Calculation example with multiple detection types and exceeded detection interval: Executing two "Range Detections" with a total detection interval of 60 minutes counts as 13 trigger calls (2 detections * 5 + 3 exceeded detection intervals).

Intelligent Monitoring Trigger Count Calculation Example: Assuming one "Host Intelligent Monitoring" is executed, it counts as 10 trigger calls.

Scheduled Reports

The number of scheduled reports sent daily within the workspace (per report /day).

Central Pipeline

Counts the size of all original log data processed by the central pipeline (per GB /day).

SMS

Counts the number of SMS sent on the day (per 10 SMS /day).

Further Reading