Telemetry ingest, storage and query
Your servers push telemetry around the clock.
We accept it, keep it in one jurisdiction, and bill per gigabyte.
Halkon terminates long-lived connections from agents running on your hosts, writes what arrives into a regional store, and gives you a query language, charts and alert rules on top. One published price per accepted gigabyte. No per-host licence, no per-seat fee, no surprise egress line.
Right now
Live counters
These four values are computed in your browser from the current clock against the ingest profile we publish. They are not a live feed — this page is static — but they follow the same daily curve the platform actually runs at, so the shape is honest.
The shape of the system
Four hops, one jurisdiction
An agent on your host opens one connection and keeps it. Everything it collects goes up that stream to the ingest point you chose. From there the data is written, indexed and read inside the same region — it is never copied to another region for storage, indexing, backup or support.
Four ways in
Protocols accepted at every ingest point
No protocol is a second-class citizen and none costs extra. Pick whatever your fleet already speaks; mix them freely within one account.
OpenTelemetry
gRPC on :4317, HTTP/protobuf and HTTP/JSON on :4318. Logs, metrics and traces. Resource attributes are preserved verbatim.
max batch 10 000 · 8 MiB compressed
Remote write
Protocol v1, snappy-framed protobuf, at /api/v1/prom/write. Labels land as event attributes; __name__ becomes the metric name.
5 M active series per account
RFC 5424 over TLS
Octet-counted framing per RFC 5425 on :6514. Structured data elements are parsed into attributes; RFC 3164 accepted with a lossy-parse flag.
64 KiB per message
Batch JSON / NDJSON
A plain POST to /v1/ingest/logs with gzip or zstd. For build pipelines, cron jobs and anything that cannot host an agent.
1 MiB per event, 512 KiB body
Full limit and retry tables: ingest reference.
Geography is a legal question
Six ingest points, pinned to a jurisdiction
Telemetry is not neutral data. Log lines carry user identifiers, request paths, internal hostnames and sometimes payload fragments. Which court can compel disclosure of that depends on where the bytes physically sit, so we let you pin it and then refuse to move it.
An account is bound to one region at creation. Data written there is stored, indexed, replicated and read there. Cross-region copying is not a setting you can turn on by accident — it requires a signed change order and a new account in the target region.
The second reason is dull physics. A host in Asia writing to a European ingest point pays 160–280 ms per round trip, which turns a 10 000-event batch into a stalled buffer. Local termination keeps acknowledgement under 40 ms for 95% of batches.
| Region | Jurisdiction | Share | Live since |
|---|---|---|---|
| eu-north-1 | EU / EEA | 27.1% | 2021-03 |
| na-east-1 | North America | 24.2% | 2022-01 |
| eu-central-1 | EU / EEA | 20.8% | 2022-06 |
| eu-west-1 | EU / EEA | 14.7% | 2023-02 |
| ap-southeast-1 | Asia-Pacific | 9.3% | 2024-04 |
| sa-east-1 | South America | 3.9% | 2025-09 |
| total | 6 regions | 100% | — |
Latency budget
What an acknowledgement costs
Acknowledgement means durably written to two of three replicas in the region, not merely received. An agent only drops a batch from its buffer after that acknowledgement, which is why the tail matters more than the median.
These figures are the trailing 90-day distribution across all six regions, recomputed at every release. The contractual availability target is lower on purpose — see the service levels.
Storage economics
What we keep and what it compresses to
Billing is on accepted bytes, before compression, because that is the number you can predict from your own fleet. Compression is our problem, not a variable in your invoice — but it is worth knowing, because it is why 400-day retention is affordable at all.
Events are normalised on arrival: timestamps to nanosecond integers, attribute keys interned per block, bodies left byte-for-byte intact. Blocks close every two hours or at 512 MiB, whichever comes first, then get zstd level 3 and an inverted index over attribute keys.
Average accepted event across the whole platform: 412 B. Metrics samples pull that down, multi-kilobyte stack traces pull it up.
Price
One number you can put in a spreadsheet
Ingest is charged per accepted gigabyte. Retention beyond the included window is charged per gigabyte-month of retained accepted volume. Queries, dashboards, alert rules, seats, agents and API calls are not metered.
| Starter | Standard | Regional | |
|---|---|---|---|
| Accepted ingest, per GB | $0.34 | $0.28 | $0.24 |
| Retention included | 15 d | 30 d | 30 d |
| Retention ceiling | 90 d | 400 d | 400 d |
| Extra retention, per GB-month | $0.021 | $0.019 | $0.017 |
| Account ingest ceiling | 50 000 ev/s | 400 000 ev/s | negotiated |
| Monthly minimum | none | $150 | $1 800 |
Worked examples, overage behaviour and the retention arithmetic: pricing.
Who sends us data
Three anonymised profiles
We do not publish customer names. These are real usage shapes with the identifying details removed, chosen because they sit at different corners of the cost model.
A logistics company running 400 hosts
Mostly structured application logs plus host metrics from the agent. Retention pushed to 180 days for a regulatory audit trail on a filtered subset.
A payments platform running 2 100 hosts
High metric cardinality, 360-day retention on a 1.2 TB audit slice, everything else dropped at 30 days. Two accounts, two jurisdictions, no data shared between them.
A game studio with a spiky event stream
Launch weekends at fourteen times the weekday floor. Uses the burst allowance rather than a raised ceiling, and accepts shedding on non-critical streams during spikes.
Next
Ten minutes to first query
Install the agent, paste an ingest key, point one service at it, and run a query. The quick start assumes nothing beyond a shell and outbound TCP 443.
-
Create an ingest key
Scoped to one region, one signal set and an optional source prefix. Keys are shown once and stored hashed.
-
Install
hkagentor point your collectorA 24 MiB static binary, or an OTLP exporter block if you already run a collector.
-
Confirm acceptance
The agent prints accepted batch counts; the ingest endpoint returns
202with a per-batch receipt id. -
Query it
from logs | where service == "checkout" | summarize count() by bin(ts, 1m)