Commercial Plan Billing Logic¶

TrueWatch Commercial Plan adopts a pay-as-you-go model, with the workspace as the billing unit. The billing cycle is calculated daily, settling data from the previous calendar day at 00:00 daily. Bills are synchronized to the Billing Center.

Settlement Process¶

Independently count the data volume generated by each service within the workspace.
Generate detailed bills based on the counted traffic.
Synchronize billing data to the Billing Center for deduction according to the selected settlement method.
- Direct settlement via Billing Center (Top-up, Prepaid Card)
- Settlement via Cloud Provider Deduction (Huawei Cloud, Alibaba Cloud, AWS, Microsoft Azure)

Concepts¶

Term	Description
Basic Billing	The unit price for billing items is a fixed value.
Tiered Billing	The unit price is tied to the data retention policy (retention period). Longer retention periods correspond to higher unit prices.
Data Retention	Customize the retention period for different data types.

Billing Items¶

Time Series¶

Counts the number of unique tag combinations per metric (per thousand per day) from the metric data reported via DataKit on the current day.

For more details, refer to Detailed Explanation of Time Series Logic.

Metric Points¶

Usage Notice

To switch from "Time Series" to "Metric Points" for metric billing, please contact your account manager.

Counts all metric data points reported within the storage period in full (per ten million points).

Logs¶

Based on feature usage, two billing methods are provided (default is per log entry).

Billing by Log Entry Count¶

Data Type	Scope of Statistics	Association with Retention Policy
Logs	Daily data increment	When "Custom Multiple Indices" is enabled, each index is counted independently, applying the unit price of its corresponding retention policy.
Events	Events generated by Monitors, SLOs, Intelligent Inspection, and custom events.	By default, uses the unit price of the log `default` index's retention policy.
Synthetic Tests (Self-built Nodes)	Synthetic test data reported by self-built test nodes.	Same as above, uses the unit price of the `default` index.

Large Log Splitting Rules

ES Storage: When a single log entry > 10 KB, Billing Count = Log Size / 10 KB
SLS Storage: When a single log entry > 2 KB, Billing Count = Log Size / 2 KB

A single data entry smaller than the above limits is counted as 1 entry.

Billing by Ingested Traffic¶

Counts the size of the original log write traffic reported by users (per GB /day).

Warning

To switch to billing by ingested traffic, please contact your account manager.

Traces¶

The system intelligently selects the billing method based on actual statistics:

If Trace Count ≥ Span Count / 10, billing is based on Trace count.
Otherwise, billing is based on Span count.

Billing Dimension	Unit	Counting Method
Trace	Per million per day	Distinct count by `trace_id`.
Span	Per ten million per day	Count of new Spans added on the day.

APM Profile¶

Counts the number of APM Profile data reported (per ten thousand per day).

Billing Notice

Profile data primarily consists of two parts: basic attribute data + Profile analysis file.

If the Profile analysis file > 300 KB, the data will be split into multiple entries for billing. Billing entry calculation formula: Billing Count = File Size / 300 KB
If the analysis file ≤ 300 KB, it is counted as 1 entry.

RUM PV¶

Counts the number of page views reported from user access (per ten thousand PVs /day).

Warning

The larger value between PV Count and PV Count / 100 is taken as the daily billing data.

For both SPA (Single Page Application) and MPA (Multi-Page Application), statistics are based on page access counts (including refreshes). Each access counts as 1 PV.

Session Replay¶

Counts the number of session_id where has_replay: true exists (per thousand Sessions/day).

Long Session Splitting

If there is an exceptionally long active Session, the Session will be split into multiple entries for billing based on time_spent:

If Session time_spent > 4 hours, Billing Count = time_spent / 4 hours
If time_spent ≤ 4 hours, it is counted as 1 Session.

Network¶

Counts the number of host in the network data reported by eBPF within the workspace (per host reporting network data /day).

Synthetic Tests¶

Enabling synthetic test tasks and obtaining test results via the test nodes provided by TrueWatch. Statistics are collected hourly for the new test data generated within that hour (per ten thousand API Tests/day).

Query Conditions

Since synthetic test data is currently stored in the default index of logs, DQL queries or statistics need to add the following filter conditions:

index = ['default'], source = ['http_dial_testing','tcp_dial_testing','icmp_dial_testing','websocket_dial_testing']

Triggers¶

Fees incurred from using features like anomaly detection, metric generation, etc. (per ten thousand times/day).

Task Type	Billing Rule	Description
Monitor Detection (Standard)	1 count/detection	Other detection types excluding sudden change, range, outlier, and log detection.
Monitor Detection (Complex)	5 counts/detection	Sudden change detection, range detection, outlier detection, log detection.
Detection Interval Overlap	+1 count/15 minutes	When the detection interval > 15 minutes, the portion exceeding 15 minutes is rounded up per 15 minutes and added.
Intelligent Monitoring (Host/Log/Application)	10 counts/execution	Each execution of detection.
Intelligent Monitoring (User Access)	100 counts/execution	Each execution of detection.
DataKit/OpenAPI Query	1 count/query	-
Metric Generation	1 count/query	Each query when metric generation is enabled.
DataFlux Func Advanced Functions	1 count/query	Each query when advanced functions are selected.
Upgrade Strategy Notification	100 counts/trigger	Recorded when an upgrade strategy is triggered and a notification is sent.

Calculation Examples¶

Standard Case: Executing 1 "Sudden Change Detection" → 5 Trigger counts.
Exceeding Detection Interval: Executing 1 "Outlier Detection" with a 30-minute detection interval → Base 5 counts + exceeding portion (30-15=15 minutes, 15/15=1) → Total 6 counts.
Multiple Detections with Exceeding Interval: Executing 2 "Range Detections" with a 60-minute detection interval → Base 2×5=10 counts + exceeding portion (60-15=45 minutes, 45/15=3) → Total 13 counts.

Data Forwarding¶

Based on the data forwarding archive type, there are two billing categories.

Forwarding Type	Unit	Counting Method
External Storage	Per GB/day	Aggregates compressed traffic by external archive type, counting daily increments.
Internal Storage	Per GB/day	Aggregates original uncompressed traffic by internal storage type, counting the total volume.

Sensitive Data Scan Traffic¶

Counts the original traffic size of sensitive data scanned based on scanning rules (per GB /day).

If a log data entry A needs to be scanned, and three fields within this data require desensitization rule processing, the system will bill separately for the desensitization scanning of these three fields.

Security Detection Scan Traffic¶

Counts the data size (compressed) actually scanned by security detection rules daily (per GB /day).

Error Records¶

Counts the number of newly associated error data entries daily, including error data reported to the Error Center (per 1,000 data entries/day).

Scheduled Reports¶

The number of times scheduled reports are sent daily within the workspace (per time/day).

Central Pipeline¶

Counts the data size of original logs processed by all Central Pipelines (per GB /day).

SMS¶

Counts the number of SMS messages sent on the day (per 10 messages/day).

Phone Call¶

Counts the number of voice notifications sent daily (per time/day).