[Entity Store] Cost estimation (COGS)

[uri-weisman]

Goal

Produce a cost estimation so we can tell customers how much it will cost to enable Entity Store v2 (COGS / cost impact). Define small, medium, and large customer profiles and estimate the incremental cost (or resource delta) for each.

Cost drivers to model

• Kibana: Extract task runs every ~30s, ~100MB memory; may require dedicated background node (ECH) or higher TaskCost (Serverless). One task per entity type × space.
• Elasticsearch: Entity indices (latest + updates data stream); updates retention 1d; indexing and search from extraction + API.
• Scale: Number of entities, log ingest volume, number of spaces (extraction can run per space).

Customer profiles (to define and estimate)

Profile	Suggested levers	Purpose
Small	Low entity count, low ingest rate, single space (e.g. <50k entities, <10GB/day logs)	Baseline "minimal" cost.
Medium	Moderate entities and low ingest rate, few spaces (e.g. 50k–500k entities, 10–100GB/day, 2–5 spaces)	Typical security customer.
Large	High entities, high log volume, many spaces (e.g. 500k+ entities, 100GB+/day, 10+ spaces)	Upper bound / "heavy" cost.

Exact thresholds (entity count, GB/day, spaces) to be agreed and documented in the ticket or a linked doc.

Deliverables

• Cost model: Incremental Kibana (CPU/memory or background node/TaskCost) and ES (storage, indexing) per profile; optional $ estimate if we have pricing inputs.
• Outcome: Clear statement per profile: "Enabling Entity Store v2 costs [X]" (e.g. +Y GB storage, +Z Kibana memory / background node, or $/month if applicable).