Skip to content

Commercial Plan Billing Logic


This document presents the billing framework for the pay-as-you-go Commercial Plan of the TrueWatch product, detailing the conditions under which each billing item is generated and the logic for price calculation.

Concepts

Term Description
Data Storage Customizable data retention duration for different data types
Basic Billing The unit price of a billing item is a fixed value
Tiered Billing The unit price of a billing item is a dynamic value, varying based on the data storage strategy chosen for the current data type

Billing Cycle

The billing cycle is calculated daily: the daily workspace usage is settled at midnight the next day, and the generated daily bill is synchronized to the Billing Center. Finally, the system deducts the corresponding consumption amount from the appropriate account based on the chosen settlement method.

Billing Items

Time Series

Counts the number of tag combinations for Metrics data reported via DataKit on the day (billed per thousand, unit: "thousand/day").

For more details, refer to Time Series Logic Explained.

Logs

Billed by Data Count

Data generated by functions such as Logs, Events, and Synthetic Tests (per million/day):

  • If the "Custom Multi-Index" feature is enabled for Logs, the daily data increment is counted based on different indexes, and the actual cost is calculated according to the unit price of the corresponding data storage strategy;
  • Events include events generated by monitoring module (monitors, SLO) configuration detection tasks, events reported by Intelligent Inspection, and user-defined events;
  • Synthetic Tests data reported by Self-built Nodes;
  • The costs for Events and Synthetic Tests data default to the unit price of the Logs "default" index data storage strategy.
Warning

Depending on the chosen storage type, oversized Logs data will be split into multiple entries for billing:

  • ES Storage: If the Log size exceeds 10 KB, the billing count for that Log = integer (Log size/10 KB)

  • SLS Storage: If the Log size exceeds 2 KB, the billing count for that Log = integer (Log size/2 KB)

If a single data entry is smaller than the above limits, it is still counted as 1 entry.

Billed by Ingested Log Volume

The size of the original Logs data volume reported by users (per GB/day).

Warning

Logs data is billed by count by default. To switch to billed by ingested volume, please contact your account manager.

Data Forwarding

External Storage Forwarding Volume Statistics

Based on different external storage types in the current workspace, the forwarded data volume is summarized. Daily incremental data is counted and billed based on data volume (unit: per GB/day).

Internal Storage Forwarding Volume Statistics

Based on data forwarded to the TrueWatch internal storage in the current workspace, the forwarded data volume is summarized. Full data is counted and billed based on data volume (unit: per GB/day).

Sensitive Data Scanning Volume

Based on scanning rules, the original data volume of scanned sensitive data is counted (per GB/day).

For example: If Log data A needs to be scanned, and three fields within this data require desensitization rule processing, the desensitization scanning for these three fields will be billed separately.

Security Detection Scanning Volume

The actual scanned data size (compressed) by daily security detection rules (per GB/day).

Network

The number of hosts reporting network data via eBPF in the workspace (per host reporting network data/day).

APM/LLM Trace

Counts the number of Traces in reported Trace data and LLM data. Generally, if the trace_id in Span data is the same, these Spans are classified under one Trace.

Warning

In the latest billing adjustment of TrueWatch, the larger value between "count/10" and the number of trace_id will be taken as the daily billing data.

APM Profile

Counts the number of reported APM Profile data (per ten thousand Profiles/day).

Billing Notes

Profile data mainly consists of two parts: basic attribute data + Profile analysis files

  • If the Profile analysis file size exceeds 300 KB, the data will be split into multiple entries for billing

  • Billing count formula: integer (Profile analysis file size / 300 KB)

  • If the analysis file is smaller than 300 KB, it is counted as 1 entry

RUM PV

Counts the number of reported page views (per ten thousand PVs/day).

Warning

In the latest billing adjustment of TrueWatch, the larger value between "count/100" and PV will be taken as the daily billing data;

Whether it is SPA (Single Page Application) or MPA (Multi Page Application), each page visit (including refresh or re-entry) counts as 1 PV.

Session Replay

Counts the number of Sessions with actual Session Replay data. Generally, it is derived by counting the number of session_id with has_replay:true in Session data (per thousand Sessions/day).

Billing Notes
  • If there is an overly active Session, the Session will be split into multiple entries based on time_spent for billing.

  • Session time_spent > 4 hours, billing count = integer (time_spent/4 hours);

  • If Session time_spent is less than the above 4 hours, it is still counted as 1 Session.

Synthetic Tests

Enables Synthetic Tests tasks and returns test results via TrueWatch provided test nodes, counting the number of new test data in hourly intervals (per ten thousand API Tests/day).

Warning

Since Synthetic Tests data is currently stored in the Logs default index, DQL queries or statistics need to add the following filter conditions to query Synthetic Tests data.

index = ['default'], source = [‘http_dial_testing',‘tcp_dial_testing’,'icmp_dial_testing','websocket_dial_testing']

Triggers

Costs generated by using anomaly detection, metric generation, and other functions (per ten thousand/day).

  • Enables monitors, SLO, and other scheduled detection tasks. Among them, monitors' mutation detection, range detection, outlier detection, and Log detection count as 5 Triggers per detection, while other detection types count as 1 Trigger per detection. Additionally, if the detection interval exceeds 15 minutes, the excess part is counted as 1 Trigger per 15 minutes;

  • Intelligent Monitoring: Host, Log, and APM intelligent detection count as 10 Triggers per detection; RUM intelligent detection counts as 100 Triggers per detection;

  • DataKit/OpenAPI queries count as 1 Trigger per query;

  • Enables metric generation, counting as 1 Trigger per query;

  • Selects advanced functions provided by the center Func, counting as 1 Trigger per query.

Calculation Examples

Monitor Trigger Count:

  1. Normal calculation example: Assuming one "Mutation Detection" is executed, it counts as 5 Triggers.
  2. Calculation example with detection interval exceeded: If the detection interval is 30 minutes, the excess part is counted as 1 Trigger per 15 minutes. For example, executing one "Outlier Detection" counts as 6 Triggers.
  3. Calculation example with multiple detection types and detection interval exceeded: Executing two "Range Detections" with a detection interval of 60 minutes counts as 13 Triggers (2 detections * 5 + 3 excess detection intervals).

Intelligent Monitoring Trigger Count Example: Assuming one "Host Intelligent Monitoring" is executed, it counts as 10 Triggers.

Scheduled Reports

The number of daily scheduled reports sent within the workspace (per report/day).

Center Pipeline

Counts the size of original Logs data processed by all center Pipelines (per GB/day).

SMS

Counts the number of SMS sent on the day (per 10 SMS/day).

Further Reading