Skip to content

Commercial Plan Billing Logic

This document presents the generation conditions and pricing calculation logic for each billing item in the pay-as-you-go billing framework of the Guance Commercial Plan product.

Concepts

Term Description
Data Storage Customizing the data retention period for different data types.
Basic Billing The unit price for a billing item is a fixed value.
Tiered Billing The unit price for a billing item is directly related to the data storage strategy you choose. Different retention period strategies are bound to different pricing standards.

Billing Cycle

The billing cycle is calculated daily: Workspace usage for each day is settled at 00:00 the next day, and the generated daily bill is synchronized to the Billing Center. Finally, the system will deduct the corresponding consumption amount from the appropriate account based on the settlement method you selected.

Billing Items

Time Series

Counts the number of tag combinations corresponding to each metric in the metric data reported via DataKit by the user that day (per thousand/day).

For more details, refer to Time Series Logic Explained.

Logs

Based on actual feature usage, there are two types of billing.

Billed by Data Count

Data generated by the use of functions such as Logs, Events, and Synthetic Tests (per million entries/day):

  • If the "Custom Multiple Indices" feature is enabled for logs, the daily data increment will be counted based on different indices, and the actual cost will be calculated according to the unit price corresponding to the data storage strategy.
  • Events include events generated by monitoring module (monitors, SLO) configuration detection tasks, events reported by Intelligent Inspection, and events custom-reported by users.
  • Synthetic testing data reported by self-built testing nodes.
  • The cost for data types like Events and Synthetic Tests defaults to using the unit price corresponding to the "default" log index's data storage strategy.
Warning

Depending on the chosen storage type, oversized log data will be split into multiple entries for billing:

  • ES Storage: If the log size exceeds 10 KB, the billed count for that log entry = integer value (log size / 10 KB)

  • SLS Storage: If the log size exceeds 2 KB, the billed count for that log entry = integer value (log size / 2 KB)

If a single piece of data is smaller than the above limit, it is still counted as 1 entry.

Billed by Ingested Traffic

The size of the raw log write traffic reported by the user (per GB /day).

Warning

Log data is billed by count by default. To switch to billing by ingested traffic, please contact your customer manager.

Data Forwarding

Based on the data forwarding archive type, there are two types of billing.

External Storage Forwarding Traffic Statistics

Based on the current workspace, summarizes the forwarding traffic (after compression) by external archive type, counts the daily increment, and bills accordingly (per GB /day).

Internal Storage Forwarding Traffic Statistics

Based on the current workspace, summarizes the forwarding traffic by internal storage type, counts the total volume, and bills accordingly (per GB /day).

Sensitive Data Scanning Traffic

Based on scanning rules, counts the size of the original traffic of scanned sensitive data (per GB /day).

For example: If log data A needs to be scanned, and three fields within this data require desensitization rule processing, billing will be applied separately for the desensitization scanning of these three fields.

Security Detection Scanning Traffic

Counts the size of data actually scanned by security detection rules daily (after compression) (per GB /day).

Network

The number of hosts counted in the network data reported by eBPF within the workspace (per host reporting network data/day).

Trace

Generally, if the number of Traces is greater than or equal to 1/10 of the number of Spans, the system defaults to using the number of Traces for final billing settlement. Otherwise, the number of Spans is used for billing settlement.

Therefore, based on actual statistics, there are two types of billing.

By Trace Count

Obtains the daily count of newly reported Traces by deduplicating trace_id (per million Traces).

By Span Count

Counts the daily number of newly reported Spans (per ten million Span entries).

Application Performance Profile

Counts the number of reported application performance Profile data (per ten thousand Profiles /day).

Billing Notes

Profile data mainly consists of two parts: basic attribute data + Profile analysis file.

  • If the Profile analysis file size exceeds 300 KB, the data will be split into multiple entries for billing.

  • Billed entry count formula: integer value (Profile analysis file size / 300 KB)

  • If the analysis file is smaller than 300 KB, it is billed as 1 entry.

RUM PV

Counts the number of page views from reported user visits (per ten thousand PVs /day).

Warning

In the latest Guance billing adjustment, the larger value between "count/100" and PV will be taken as the daily billing data for settlement.

Whether it's an SPA (Single Page Application) or an MPA (Multi-Page Application), each user visit to a page (including refresh or re-entry) counts as 1 PV.

Session Replay

Counts the number of Sessions that actually generated session replay data. Generally obtained by counting the number of session_ids with has_replay:true in the Session data (per thousand Sessions /day).

Billing Notes

  • If there are ultra-long active Sessions, the Session will be split into multiple entries for billing based on time_spent;

  • Session time_spent > 4 hours, billed count = integer value (time_spent / 4 hours);

  • If Session time_spent is less than the aforementioned 4 hours, it is still calculated as 1 Session.

Synthetic Tests

Enable synthetic testing tasks and obtain test results through the testing nodes provided by Guance. The number of new test data points added within a one-hour interval is counted (per ten thousand API tests/day).

Warning

Since synthetic test data is currently stored in the default log index, DQL queries or statistics need to add the following filter conditions to query synthetic test data.

index = ['default'], source = [‘http_dial_testing',‘tcp_dial_testing’,'icmp_dial_testing','websocket_dial_testing']

Triggers

Costs generated by using functions like anomaly detection and metric generation (per ten thousand executions /day).

  • Enabling scheduled detection tasks for monitors, SLOs, etc. Among these, monitor mutation detection, range detection, outlier detection, and log detection count as 5 trigger executions per detection, while other detection types count as 1 trigger execution. Additionally, if the detection interval exceeds 15 minutes, the excess part adds 1 trigger execution per 15 minutes;

  • Intelligent Monitoring: Host, log, and application intelligent detection count as 10 trigger executions per detection run; user access intelligent detection counts as 100 trigger executions per detection run;

  • Each DataKit/OpenAPI query counts as 1 trigger execution;

  • Enabling metric generation counts each query as 1 trigger execution;

  • Selecting advanced functions provided by DataFlux Func counts each query as 1 trigger execution.

Calculation Example

Monitor trigger count example:

  1. Normal case calculation example: Assuming one execution of "Mutation Detection" is calculated as 5 trigger executions.
  2. Calculation example when exceeding the detection interval: If the detection interval is 30 minutes, the excess part adds 1 per 15 minutes (rounded up). For example, one execution of "Outlier Detection" is calculated as 6 trigger executions.
  3. Calculation example for multiple detection types exceeding the interval: Executing two "Range Detections" with a combined detection interval of 60 minutes is calculated as 13 trigger executions (2 detections * 5 + 3 excess intervals).

Intelligent Monitoring trigger count example: Assuming one execution of "Host Intelligent Monitoring" is calculated as 10 trigger executions.

Scheduled Reports

The number of times scheduled reports are sent daily within the workspace (per time /day).

Central Pipeline

Counts the size of all raw log data processed by the central Pipeline (per GB /day).

SMS

Counts the number of SMS messages sent that day (per 10 messages /day).

Phone Call (IVR)

Counts the number of voice notifications sent daily (per time /day).

Further Reading

Feedback

Is this page helpful? ×