Cost savings
The initial production extrapolation and its evidence limits.
This document estimates Filomena's potential cost savings using production data from the
alert-triage service between 2026-08-20 10:04 UTC and 2026-08-22 17:13 UTC. It compares
the observed workflow with hosted AIOps pricing and with manual investigation time.
The estimates are directional. The production sample covers 55.1 hours, and only two investigations received explicit human feedback. These numbers do not yet prove time saved, diagnostic accuracy, or reduced MTTR.
Observed production volume
The production ClickHouse data contained:
| Measurement | Observed value |
|---|---|
| Observation period | 55.1 hours |
| Alert lifecycle events | 589 |
| Firing events | 292 |
| Distinct fingerprints | 195 |
| Completed AI investigations | 214 |
| Feedback responses | 2 |
| Correct feedback | 1 |
| Partial feedback | 1 |
The alert distribution included container restart loops, ActiveMQ consumer count alerts, Argo CD application health alerts, failed jobs, Application Gateway latency and error-rate alerts, ExternalSecret failures, and Kubernetes workload-state alerts.
The running service used approximately 1 millicore of CPU and 86 MiB of memory when sampled. Its Kubernetes requests were 100 millicores and 256 MiB for one replica.
Monthly volume projection
A 30-day month contains 720 hours. The normalization factor is:
720 / 55.1458 = 13.056
Applying that factor to the observed volume gives:
| Measurement | Projected 30-day volume |
|---|---|
| Alert lifecycle events | 7,690 |
| Completed AI investigations | 2,794 |
This projection assumes the sample represents normal production traffic. A rollout spike, an incident burst, alert-rule changes, or seasonal traffic would invalidate that assumption.
Filomena operating cost
Model cost
The production service used openai/gpt-5.4-mini. Stored completed runs averaged:
| Data | Average characters per investigation |
|---|---|
| Evidence JSON | 2,463 |
| Prior-case JSON | 2,007 |
| Diagnosis JSON | 1,420 |
These are stored character counts, not provider token-accounting records. They support a reasonable range of approximately 2,500 to 3,000 input tokens and 500 to 900 output tokens per investigation after prompt and schema overhead. Invalid model responses can cause a second model request.
GPT-5.4 mini currently costs $0.75 per million input tokens and $4.50 per million output tokens. At 2,794 monthly investigations:
Lower estimate:
2,794 * ((2,500 * $0.75) + (500 * $4.50)) / 1,000,000 = $11.53/month
Higher single-call estimate:
2,794 * ((3,000 * $0.75) + (900 * $4.50)) / 1,000,000 = $17.60/month
Allowing for retries and token-estimation error gives a working range of $12 to $35 per month. This excludes any markup or discount applied by an internal AI gateway.
Source: OpenAI GPT-5.4 mini pricing
Compute cost
The pod ran on an Azure Standard_B4ps_v2 node in East US. The node's sampled public
consumption price was $0.134 per hour. Allocating node cost using the pod's 100 millicore CPU
request gives approximately $2.50 per month:
100m / 3,860m allocatable CPU * $0.134/hour * 720 hours = $2.50/month
The observed 1 millicore consumption was materially below the request. Existing ClickHouse, VictoriaMetrics, Kubernetes, Grafana, and Slack costs are treated as sunk platform costs because alert-triage queries the telemetry stack already in use. A deployment requiring a new telemetry backend must include that infrastructure in its TCO.
Operations cost
The repository TCO benchmark uses two maintenance hours per month and a $100 engineering hourly rate:
2 hours * $100/hour = $200/month
This is an assumption. Actual upgrade, support, diagnostic-pack maintenance, and incident response time must replace it after a longer operating period.
Estimated monthly TCO
| Component | Monthly estimate |
|---|---|
| Model inference | $12 to $35 |
| Allocated compute | About $3 |
| Operations | $200 |
| Total | $215 to $240 |
The marginal runtime cost without assigned maintenance labor is approximately $15 to $40 per month.
Hosted AIOps comparison
Datadog Bits Investigation
Datadog states that a Bits Investigation autonomous investigation consumes approximately 6.5 AI credits. Datadog AI credits start at $500 per 500 monthly credits with annual billing, or $1.30 per credit on demand.
At the projected volume:
2,794 investigations * 6.5 credits = 18,161 credits/month
Annual-billing unit price:
18,161 credits * $1.00 = $18,161/month
On-demand unit price:
18,161 credits * $1.30 = $23,609/month
This comparison covers the AI investigation layer. It excludes Datadog infrastructure monitoring, APM, logs, retention, and telemetry ingestion charges. Those costs would be additional if the organization did not already use Datadog.
Source: Datadog pricing
PagerDuty AIOps
PagerDuty AIOps starts at $699 per month and is priced by accepted event consumption. The public page does not expose the exact price tier for approximately 7,690 monthly events. PagerDuty Incident Management seats and other AI add-ons may also apply.
Source: PagerDuty pricing
Grafana and Dynatrace
Grafana IRM starts at $20 per active user plus its platform fee, but IRM is not an equivalent price comparison for automated evidence collection and diagnosis. Grafana does not publish a clear standalone unit price for Assistant Investigations suitable for this calculation.
Dynatrace includes causal root-cause analysis within a broader consumption-based observability platform. Its cost depends on monitored hosts, memory, pods, logs, and an annual platform commitment. Comparing only the investigation workflow would require an actual quote and the current monitored estate.
Sources:
Estimated hosted-tool savings
Using the $215 to $240 Filomena TCO range:
| Comparison | Monthly saving | Percentage saving |
|---|---|---|
| PagerDuty published floor | $459 to $484 | 66% to 69% |
| Datadog annual-billing unit price | $17,921 to $17,946 | About 98.7% |
| Datadog on-demand unit price | $23,369 to $23,394 | About 99.0% |
PagerDuty's actual saving cannot be established without the event-tier quote. Datadog's comparison assumes every completed alert-triage run maps to one Bits Investigation. Hosted products also include platform capabilities beyond Filomena's investigation workflow.
Potential engineering capacity
Completed AI investigations do not automatically equal avoided human investigations. The following scenarios estimate capacity value by varying both the percentage of investigations that would otherwise require an engineer and the time saved on each one.
| Scenario | Assumption | Monthly hours | Value at $100/hour |
|---|---|---|---|
| Conservative | 25% save 5 minutes | 58 | $5,800 |
| Base | 50% save 10 minutes | 233 | $23,300 |
| High | 75% save 15 minutes | 524 | $52,400 |
The base calculation is:
2,794 investigations * 50% * 10 minutes / 60 = 232.8 hours/month
232.8 hours * $100/hour = $23,280/month
Treat these figures as capacity value until product telemetry demonstrates reduced manual investigation time. Capacity does not become cash savings unless it avoids hiring, contractor expense, overtime, or other paid work.
Do not add hosted subscription savings and engineering capacity savings when the hosted alternative would provide the same time reduction. That would double-count the benefit.
Evidence limitations
- The observation period covered only 55.1 hours.
- Only two of 214 completed investigations received feedback.
- The current data does not establish diagnostic precision or recall.
- A completed diagnosis does not prove an engineer read or used it.
- The current data does not contain a pre-deployment MTTA or MTTR baseline.
- Token costs are inferred from stored character counts rather than gateway usage records.
- AI gateway markup, discounts, cached tokens, and reasoning tokens are unknown.
- Two monthly maintenance hours are assumed rather than measured.
- Public vendor prices are list-price references, not negotiated quotes.
- Hosted products have broader feature sets, so this is workflow-level rather than complete platform parity.
Required measurement
Filomena should collect the following before publishing a savings claim:
- Actual input, cached-input, reasoning, and output tokens for every model request.
- Actual provider or gateway USD cost for every request.
- Retry count and cost per investigation.
- Investigation delivery, opened, expanded, accepted, dismissed, and feedback events.
- Correct, partial, incorrect, and no-evidence rates by diagnostic pack and alert type.
- Time from alert firing to first diagnosis.
- Time to acknowledge, mitigate, resolve, and close each workload incident.
- A pre-Filomena baseline for the same alerts, services, and on-call teams.
- Monthly maintenance and diagnostic-pack engineering hours.
- Current vendor quotes captured with quote date, included capabilities, telemetry volume, retention, seats, support, and contract term.
The existing /v1/economics endpoint and benchmarks/tco/calculate.py provide the basis for
a reproducible report. The production deployment should feed actual usage into that model
instead of relying on character-based token estimates.
Defensible claim after validation
After at least 30 days of production data, sufficient human feedback, and a pre-deployment baseline, a publishable claim can use this form:
At the observed monthly volume of N investigations, Filomena cost $X to operate, reduced median investigation time from A to B minutes, and cost Y% less than a dated hosted AIOps quote covering the same event and telemetry volume.
Until those measurements exist, the supported claim is narrower:
The initial 55-hour production sample projects approximately 2,794 investigations per month. At public model rates and measured compute allocation, Filomena's marginal runtime cost is estimated at $15 to $40 per month before maintenance.