[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-posthog-authoring-log-alerts":3,"mdc-2ipnau-key":51,"related-org-posthog-authoring-log-alerts":2127,"related-repo-posthog-authoring-log-alerts":2287},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":46,"sourceUrl":49,"mdContent":50},"authoring-log-alerts","author log alerts in PostHog","Author useful, low-noise log alerts on services in a PostHog project. Use when the user asks to set up alerts for their logs, suggest alerts they should add, or evaluate whether a service is worth monitoring. Covers service triage, baseline characterisation, threshold drafting, back-testing via simulate, and shipping with a notification destination.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"posthog","PostHog","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fposthog.png",[12,16,19,20,23],{"name":13,"slug":14,"type":15},"Observability","observability","tag",{"name":17,"slug":18,"type":15},"Operations","operations",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"Monitoring","monitoring",{"name":24,"slug":25,"type":15},"Analytics","analytics",35568,"https:\u002F\u002Fgithub.com\u002FPostHog\u002Fposthog","2026-07-18T05:10:54.430898",null,2977,[32,33,25,34,35,36,37,38,39,40,41,42,43,44,45],"ab-testing","ai-analytics","cdp","data-warehouse","experiments","feature-flags","javascript","product-analytics","python","react","session-replay","surveys","typescript","web-analytics",{"repoUrl":27,"stars":26,"forks":30,"topics":47,"description":48},[32,33,25,34,35,36,37,38,39,40,41,42,43,44,45],"🦔 PostHog is an all-in-one developer platform for building successful products. We offer product analytics, web analytics, session replay, error tracking, feature flags, experimentation, surveys, data warehouse, a CDP, and an AI product assistant to help debug your code, ship features faster, and keep all your usage and customer data in one stack.","https:\u002F\u002Fgithub.com\u002FPostHog\u002Fposthog\u002Ftree\u002FHEAD\u002Fproducts\u002Flogs\u002Fskills\u002Fauthoring-log-alerts","---\nname: authoring-log-alerts\ndescription: >\n  Author useful, low-noise log alerts on services in a PostHog project. Use when the user asks to set up\n  alerts for their logs, suggest alerts they should add, or evaluate whether a service is worth monitoring.\n  Covers service triage, baseline characterisation, threshold drafting, back-testing via simulate, and\n  shipping with a notification destination.\n---\n\n# Authoring log alerts\n\nAuthoring an alert is a _measurement_ problem, not a guessing problem. You are not trying to be exhaustive — you\nare trying to land thresholds that fire 0–3 times per week on real production patterns, on services that matter.\n\n## When to use this skill\n\n- The user asks to \"set up alerts\" \u002F \"suggest alerts\" for their project.\n- The user wants to evaluate whether a service is producing alertable signal.\n- The user has just enabled log alerting and wants a starter set.\n\n## When _not_ to use this skill\n\n- Tuning an alert that already exists — that's a different job (use `posthog:logs-alerts-events-list` to inspect\n  fire\u002Fresolve cadence and `posthog:logs-alerts-partial-update` to adjust).\n- Investigating an active incident — pull rows with `posthog:query-logs`, don't author an alert mid-incident.\n\n## Tools\n\n| Tool                                                                  | Job                                                                           | Where it fits      |\n| --------------------------------------------------------------------- | ----------------------------------------------------------------------------- | ------------------ |\n| `posthog:logs-services`                                               | Top-25 services in window with log_count, error_count, error_rate, sparkline. | Step 1 — triage.   |\n| `posthog:logs-attributes-list` \u002F `posthog:logs-attribute-values-list` | Discover keys\u002Fvalues for narrower filters.                                    | Step 2, optional.  |\n| `posthog:logs-count-ranges`                                           | Adaptive time-bucketed counts for a filter.                                   | Step 3 — baseline. |\n| `posthog:logs-alerts-simulate-create`                                 | Replay a draft config against `-7d` history with full state machine.          | Step 4 — validate. |\n| `posthog:logs-alerts-create`                                          | Persist the alert.                                                            | Step 5 — ship.     |\n| `posthog:logs-alerts-destinations-create`                             | Wire the alert to Slack, webhook, or Microsoft Teams.                         | Step 5: ship.      |\n\nDo **not** call `posthog:query-logs` during authoring. You need distributions, not rows. Reserve `posthog:query-logs` for\nthe very end if the user asks \"show me a sample of what would have fired\" — `limit: 10` is plenty.\n\n## Workflow\n\n### 1. Triage — pick candidate services\n\nCall `posthog:logs-services` for the last 24h with no filters. The response is capped at 25 services and includes a\nsparkline, so it is small and bounded.\n\nA service is a candidate when **both** are true:\n\n- `log_count` is non-trivial (≥ ~1k in 24h — quieter services produce too little signal to alert on).\n- `error_rate` is non-zero, **or** the user has named the service explicitly.\n\nSkip services with high volume but `error_rate == 0` unless the user wants a volume-shape alert (e.g. \"warn me\nif api-gateway suddenly stops producing logs\"). Volume-floor alerts use `threshold_operator: below` and need\ndifferent reasoning — see [references\u002Fvolume-floor-alerts.md](.\u002Freferences\u002Fvolume-floor-alerts.md).\n\nIf the user names a service, treat it as a candidate even without error signal.\n\n### 2. (Optional) Narrow the filter\n\nIf a service has many error sub-types, an alert on \"all errors\" is usually too broad. Use\n`posthog:logs-attributes-list` (try `attribute_type: log`) and `posthog:logs-attribute-values-list` to find a discriminator —\ncommon ones are `http.status_code`, `error.type`, `k8s.container.name`. Add the narrowing filter to your draft.\n\nKeep it simple: one severity filter + one or two attribute filters is plenty. Multi-clause filters are\nharder to reason about and rarely improve precision.\n\n### 3. Baseline — characterise the candidate over 7 days\n\nCall `posthog:logs-count-ranges` with the candidate's filters, `dateRange: { date_from: \"-7d\" }`, and\n`targetBuckets: 24` (one bucket ≈ 7h). The response gives you bucket counts.\n\n**Do not eyeball the percentiles or scale the threshold to the alert window manually.** Pipe the\ncount-ranges response into the helper script:\n\n```bash\necho '\u003Ccount-ranges JSON>' | python3 scripts\u002Fbaseline_stats.py --window-minutes 5\n```\n\nThe script returns:\n\n```json\n{\n  \"n_buckets\": 12,\n  \"bucket_minutes\": 420.0,\n  \"alert_window_minutes\": 5,\n  \"stats\": { \"p50\": 12.0, \"p95\": 71.25, \"p99\": 126.25, \"max\": 140 },\n  \"suggested_threshold_count\": 5,\n  \"rationale\": \"max(p99=126.25, median*3=36.0, floor=5) scaled from 420m bucket to 5m window\",\n  \"health\": []\n}\n```\n\nUse `suggested_threshold_count` as your starting threshold. Read `health`:\n\n| `health` flag           | What it means                                | What to do                                                                                                 |\n| ----------------------- | -------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |\n| `sparse:N_of_M_buckets` | Too few non-empty buckets for a 7d baseline. | Widen filter, extend to `-30d`, or skip.                                                                   |\n| `empty`                 | All buckets are zero.                        | Skip — no signal.                                                                                          |\n| `spiky`                 | `max` is 10×+ `p95`.                         | Count-threshold alerts work well. Proceed.                                                                 |\n| `flat`                  | `p95` ≈ `p50`.                               | Be cautious — either no incidents in lookback, or the metric is too smooth. Try a longer lookback or skip. |\n| `[]` (empty)            | Healthy distribution.                        | Proceed.                                                                                                   |\n\n### 4. Draft and simulate\n\nPick a starter draft from these defaults — see [references\u002Fthreshold-defaults.md](.\u002Freferences\u002Fthreshold-defaults.md)\nfor the reasoning:\n\n| Setting               | Default                                     | Notes                                                                 |\n| --------------------- | ------------------------------------------- | --------------------------------------------------------------------- |\n| `threshold_count`     | `suggested_threshold_count` from the script | Already scaled to the alert window.                                   |\n| `threshold_operator`  | `above`                                     | Use `below` only for volume-floor alerts.                             |\n| `window_minutes`      | `5`                                         | Allowed: 5, 10, 15, 30, 60. Must match what you passed to the script. |\n| `evaluation_periods`  | `3`                                         | M in N-of-M.                                                          |\n| `datapoints_to_alarm` | `2`                                         | N in N-of-M. 2-of-3 reduces flap from a single noisy bucket.          |\n| `cooldown_minutes`    | `30`                                        | Minimum time between repeat fires.                                    |\n\nCall `posthog:logs-alerts-simulate-create` with these settings and `date_from: \"-7d\"`. The response gives you `fire_count`\nand `resolve_count`.\n\n### 5. Iterate — three rounds, then ship or skip\n\nTarget: `fire_count` between 0 and ~3 over `-7d`. If outside the band:\n\n| Outcome                                                         | Adjustment                                                                                           |\n| --------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |\n| `fire_count` = 0 over 7d _and_ the baseline was spiky           | Lower `threshold_count` toward `stats.p95` from the script, or drop to 1-of-2.                       |\n| `fire_count` = 0 _and_ the baseline was flat                    | The service has no alertable signal. Skip it; log why.                                               |\n| `fire_count` > 5                                                | Raise `threshold_count` toward `stats.max` from the script, or move to 3-of-5 for a smoother window. |\n| `fire_count` is fine but resolve_count never matches fire_count | Cooldown is too long, or the underlying state is genuinely sticky. Acceptable for now.               |\n\nWhen adjusting the threshold, **read values from the script's `stats` block — never recompute percentiles\nby hand.**\n\nCap iteration at **3 simulate calls per candidate**. If you can't land in the band in 3 rounds, the metric\nis wrong — either the filter is too broad, the window is wrong, or the service genuinely doesn't have a\nthreshold-shape signal. Note it and move on.\n\n### 6. Ship — create + attach destination\n\nOnce a draft simulates cleanly:\n\n1. Call `posthog:logs-alerts-create` with the validated config. Use a name like `\u003Cservice> error rate (auto)` so the\n   user can see at a glance which alerts came from this skill.\n2. Call `posthog:logs-alerts-destinations-create` to wire it to a notification target. **An alert with no destination\n   is silent.** Supported destination fields:\n   - Slack: `type: \"slack\"`, `slack_workspace_id`, and `slack_channel_id`. `slack_channel_name` is optional.\n   - Webhook: `type: \"webhook\"` and `webhook_url`.\n   - Microsoft Teams: `type: \"teams\"` and `webhook_url`.\n\n   Always confirm the channel name or webhook URL with the user before attaching. Never wire\n   an auto-generated alert to a production channel without explicit confirmation. If the user is unsure,\n   suggest a low-traffic testing channel for the first few alerts.\n\nIf the user wants alerts created in `enabled: false` state for review-then-flip, pass `enabled: false` to\n`-create` and tell them how many drafts you produced.\n\n## Filter shape — required\n\nThe `filters` field on `posthog:logs-alerts-create` takes a subset of `LogsViewerFilters` and **must contain at\nleast one of**:\n\n- `severityLevels` — list of `[\"trace\",\"debug\",\"info\",\"warn\",\"error\",\"fatal\"]`\n- `serviceNames` — list of service name strings\n- `filterGroup` — property filter group\n\nThe same shape goes into `posthog:logs-alerts-simulate-create`'s `filters` field. Match the simulate filters to the alert filters\nexactly — otherwise the simulation is testing a different alert than the one you ship.\n\nExample minimum:\n\n```json\n{\n  \"severityLevels\": [\"error\", \"fatal\"],\n  \"serviceNames\": [\"api-gateway\"]\n}\n```\n\n## Token-economy rules\n\n- One `posthog:logs-services` call at the start, not per-candidate.\n- One `posthog:logs-count-ranges` call per candidate at `targetBuckets: 24`. Don't go above 30 during authoring.\n- ≤ 3 `posthog:logs-alerts-simulate-create` calls per candidate.\n- Zero `posthog:query-logs` calls during the authoring loop.\n- Prefer reporting a small set of well-validated alerts over a long list of unvalidated drafts.\n\n## Output\n\nReport what you did, in this shape:\n\n- For each shipped alert: name, filters, threshold, simulated fire_count over 7d, destination.\n- For each skipped candidate: service name + why (flat baseline, can't land threshold, low volume).\n- Total simulate calls made, total alerts created.\n\nThe user should be able to read this and decide whether to disable any drafts before they go live.\n",{"data":52,"body":53},{"name":4,"description":6},{"type":54,"children":55},"root",[56,64,78,85,105,118,156,162,343,377,383,390,402,414,446,476,481,487,537,542,548,575,585,652,657,1004,1022,1196,1202,1215,1406,1440,1446,1465,1601,1618,1630,1636,1641,1765,1793,1799,1832,1874,1893,1898,2019,2025,2087,2093,2098,2116,2121],{"type":57,"tag":58,"props":59,"children":60},"element","h1",{"id":4},[61],{"type":62,"value":63},"text","Authoring log alerts",{"type":57,"tag":65,"props":66,"children":67},"p",{},[68,70,76],{"type":62,"value":69},"Authoring an alert is a ",{"type":57,"tag":71,"props":72,"children":73},"em",{},[74],{"type":62,"value":75},"measurement",{"type":62,"value":77}," problem, not a guessing problem. You are not trying to be exhaustive — you\nare trying to land thresholds that fire 0–3 times per week on real production patterns, on services that matter.",{"type":57,"tag":79,"props":80,"children":82},"h2",{"id":81},"when-to-use-this-skill",[83],{"type":62,"value":84},"When to use this skill",{"type":57,"tag":86,"props":87,"children":88},"ul",{},[89,95,100],{"type":57,"tag":90,"props":91,"children":92},"li",{},[93],{"type":62,"value":94},"The user asks to \"set up alerts\" \u002F \"suggest alerts\" for their project.",{"type":57,"tag":90,"props":96,"children":97},{},[98],{"type":62,"value":99},"The user wants to evaluate whether a service is producing alertable signal.",{"type":57,"tag":90,"props":101,"children":102},{},[103],{"type":62,"value":104},"The user has just enabled log alerting and wants a starter set.",{"type":57,"tag":79,"props":106,"children":108},{"id":107},"when-not-to-use-this-skill",[109,111,116],{"type":62,"value":110},"When ",{"type":57,"tag":71,"props":112,"children":113},{},[114],{"type":62,"value":115},"not",{"type":62,"value":117}," to use this skill",{"type":57,"tag":86,"props":119,"children":120},{},[121,143],{"type":57,"tag":90,"props":122,"children":123},{},[124,126,133,135,141],{"type":62,"value":125},"Tuning an alert that already exists — that's a different job (use ",{"type":57,"tag":127,"props":128,"children":130},"code",{"className":129},[],[131],{"type":62,"value":132},"posthog:logs-alerts-events-list",{"type":62,"value":134}," to inspect\nfire\u002Fresolve cadence and ",{"type":57,"tag":127,"props":136,"children":138},{"className":137},[],[139],{"type":62,"value":140},"posthog:logs-alerts-partial-update",{"type":62,"value":142}," to adjust).",{"type":57,"tag":90,"props":144,"children":145},{},[146,148,154],{"type":62,"value":147},"Investigating an active incident — pull rows with ",{"type":57,"tag":127,"props":149,"children":151},{"className":150},[],[152],{"type":62,"value":153},"posthog:query-logs",{"type":62,"value":155},", don't author an alert mid-incident.",{"type":57,"tag":79,"props":157,"children":159},{"id":158},"tools",[160],{"type":62,"value":161},"Tools",{"type":57,"tag":163,"props":164,"children":165},"table",{},[166,190],{"type":57,"tag":167,"props":168,"children":169},"thead",{},[170],{"type":57,"tag":171,"props":172,"children":173},"tr",{},[174,180,185],{"type":57,"tag":175,"props":176,"children":177},"th",{},[178],{"type":62,"value":179},"Tool",{"type":57,"tag":175,"props":181,"children":182},{},[183],{"type":62,"value":184},"Job",{"type":57,"tag":175,"props":186,"children":187},{},[188],{"type":62,"value":189},"Where it fits",{"type":57,"tag":191,"props":192,"children":193},"tbody",{},[194,217,247,269,299,321],{"type":57,"tag":171,"props":195,"children":196},{},[197,207,212],{"type":57,"tag":198,"props":199,"children":200},"td",{},[201],{"type":57,"tag":127,"props":202,"children":204},{"className":203},[],[205],{"type":62,"value":206},"posthog:logs-services",{"type":57,"tag":198,"props":208,"children":209},{},[210],{"type":62,"value":211},"Top-25 services in window with log_count, error_count, error_rate, sparkline.",{"type":57,"tag":198,"props":213,"children":214},{},[215],{"type":62,"value":216},"Step 1 — triage.",{"type":57,"tag":171,"props":218,"children":219},{},[220,237,242],{"type":57,"tag":198,"props":221,"children":222},{},[223,229,231],{"type":57,"tag":127,"props":224,"children":226},{"className":225},[],[227],{"type":62,"value":228},"posthog:logs-attributes-list",{"type":62,"value":230}," \u002F ",{"type":57,"tag":127,"props":232,"children":234},{"className":233},[],[235],{"type":62,"value":236},"posthog:logs-attribute-values-list",{"type":57,"tag":198,"props":238,"children":239},{},[240],{"type":62,"value":241},"Discover keys\u002Fvalues for narrower filters.",{"type":57,"tag":198,"props":243,"children":244},{},[245],{"type":62,"value":246},"Step 2, optional.",{"type":57,"tag":171,"props":248,"children":249},{},[250,259,264],{"type":57,"tag":198,"props":251,"children":252},{},[253],{"type":57,"tag":127,"props":254,"children":256},{"className":255},[],[257],{"type":62,"value":258},"posthog:logs-count-ranges",{"type":57,"tag":198,"props":260,"children":261},{},[262],{"type":62,"value":263},"Adaptive time-bucketed counts for a filter.",{"type":57,"tag":198,"props":265,"children":266},{},[267],{"type":62,"value":268},"Step 3 — baseline.",{"type":57,"tag":171,"props":270,"children":271},{},[272,281,294],{"type":57,"tag":198,"props":273,"children":274},{},[275],{"type":57,"tag":127,"props":276,"children":278},{"className":277},[],[279],{"type":62,"value":280},"posthog:logs-alerts-simulate-create",{"type":57,"tag":198,"props":282,"children":283},{},[284,286,292],{"type":62,"value":285},"Replay a draft config against ",{"type":57,"tag":127,"props":287,"children":289},{"className":288},[],[290],{"type":62,"value":291},"-7d",{"type":62,"value":293}," history with full state machine.",{"type":57,"tag":198,"props":295,"children":296},{},[297],{"type":62,"value":298},"Step 4 — validate.",{"type":57,"tag":171,"props":300,"children":301},{},[302,311,316],{"type":57,"tag":198,"props":303,"children":304},{},[305],{"type":57,"tag":127,"props":306,"children":308},{"className":307},[],[309],{"type":62,"value":310},"posthog:logs-alerts-create",{"type":57,"tag":198,"props":312,"children":313},{},[314],{"type":62,"value":315},"Persist the alert.",{"type":57,"tag":198,"props":317,"children":318},{},[319],{"type":62,"value":320},"Step 5 — ship.",{"type":57,"tag":171,"props":322,"children":323},{},[324,333,338],{"type":57,"tag":198,"props":325,"children":326},{},[327],{"type":57,"tag":127,"props":328,"children":330},{"className":329},[],[331],{"type":62,"value":332},"posthog:logs-alerts-destinations-create",{"type":57,"tag":198,"props":334,"children":335},{},[336],{"type":62,"value":337},"Wire the alert to Slack, webhook, or Microsoft Teams.",{"type":57,"tag":198,"props":339,"children":340},{},[341],{"type":62,"value":342},"Step 5: ship.",{"type":57,"tag":65,"props":344,"children":345},{},[346,348,353,355,360,362,367,369,375],{"type":62,"value":347},"Do ",{"type":57,"tag":349,"props":350,"children":351},"strong",{},[352],{"type":62,"value":115},{"type":62,"value":354}," call ",{"type":57,"tag":127,"props":356,"children":358},{"className":357},[],[359],{"type":62,"value":153},{"type":62,"value":361}," during authoring. You need distributions, not rows. Reserve ",{"type":57,"tag":127,"props":363,"children":365},{"className":364},[],[366],{"type":62,"value":153},{"type":62,"value":368}," for\nthe very end if the user asks \"show me a sample of what would have fired\" — ",{"type":57,"tag":127,"props":370,"children":372},{"className":371},[],[373],{"type":62,"value":374},"limit: 10",{"type":62,"value":376}," is plenty.",{"type":57,"tag":79,"props":378,"children":380},{"id":379},"workflow",[381],{"type":62,"value":382},"Workflow",{"type":57,"tag":384,"props":385,"children":387},"h3",{"id":386},"_1-triage-pick-candidate-services",[388],{"type":62,"value":389},"1. Triage — pick candidate services",{"type":57,"tag":65,"props":391,"children":392},{},[393,395,400],{"type":62,"value":394},"Call ",{"type":57,"tag":127,"props":396,"children":398},{"className":397},[],[399],{"type":62,"value":206},{"type":62,"value":401}," for the last 24h with no filters. The response is capped at 25 services and includes a\nsparkline, so it is small and bounded.",{"type":57,"tag":65,"props":403,"children":404},{},[405,407,412],{"type":62,"value":406},"A service is a candidate when ",{"type":57,"tag":349,"props":408,"children":409},{},[410],{"type":62,"value":411},"both",{"type":62,"value":413}," are true:",{"type":57,"tag":86,"props":415,"children":416},{},[417,428],{"type":57,"tag":90,"props":418,"children":419},{},[420,426],{"type":57,"tag":127,"props":421,"children":423},{"className":422},[],[424],{"type":62,"value":425},"log_count",{"type":62,"value":427}," is non-trivial (≥ ~1k in 24h — quieter services produce too little signal to alert on).",{"type":57,"tag":90,"props":429,"children":430},{},[431,437,439,444],{"type":57,"tag":127,"props":432,"children":434},{"className":433},[],[435],{"type":62,"value":436},"error_rate",{"type":62,"value":438}," is non-zero, ",{"type":57,"tag":349,"props":440,"children":441},{},[442],{"type":62,"value":443},"or",{"type":62,"value":445}," the user has named the service explicitly.",{"type":57,"tag":65,"props":447,"children":448},{},[449,451,457,459,465,467,474],{"type":62,"value":450},"Skip services with high volume but ",{"type":57,"tag":127,"props":452,"children":454},{"className":453},[],[455],{"type":62,"value":456},"error_rate == 0",{"type":62,"value":458}," unless the user wants a volume-shape alert (e.g. \"warn me\nif api-gateway suddenly stops producing logs\"). Volume-floor alerts use ",{"type":57,"tag":127,"props":460,"children":462},{"className":461},[],[463],{"type":62,"value":464},"threshold_operator: below",{"type":62,"value":466}," and need\ndifferent reasoning — see ",{"type":57,"tag":468,"props":469,"children":471},"a",{"href":470},".\u002Freferences\u002Fvolume-floor-alerts.md",[472],{"type":62,"value":473},"references\u002Fvolume-floor-alerts.md",{"type":62,"value":475},".",{"type":57,"tag":65,"props":477,"children":478},{},[479],{"type":62,"value":480},"If the user names a service, treat it as a candidate even without error signal.",{"type":57,"tag":384,"props":482,"children":484},{"id":483},"_2-optional-narrow-the-filter",[485],{"type":62,"value":486},"2. (Optional) Narrow the filter",{"type":57,"tag":65,"props":488,"children":489},{},[490,492,497,499,505,507,512,514,520,522,528,529,535],{"type":62,"value":491},"If a service has many error sub-types, an alert on \"all errors\" is usually too broad. Use\n",{"type":57,"tag":127,"props":493,"children":495},{"className":494},[],[496],{"type":62,"value":228},{"type":62,"value":498}," (try ",{"type":57,"tag":127,"props":500,"children":502},{"className":501},[],[503],{"type":62,"value":504},"attribute_type: log",{"type":62,"value":506},") and ",{"type":57,"tag":127,"props":508,"children":510},{"className":509},[],[511],{"type":62,"value":236},{"type":62,"value":513}," to find a discriminator —\ncommon ones are ",{"type":57,"tag":127,"props":515,"children":517},{"className":516},[],[518],{"type":62,"value":519},"http.status_code",{"type":62,"value":521},", ",{"type":57,"tag":127,"props":523,"children":525},{"className":524},[],[526],{"type":62,"value":527},"error.type",{"type":62,"value":521},{"type":57,"tag":127,"props":530,"children":532},{"className":531},[],[533],{"type":62,"value":534},"k8s.container.name",{"type":62,"value":536},". Add the narrowing filter to your draft.",{"type":57,"tag":65,"props":538,"children":539},{},[540],{"type":62,"value":541},"Keep it simple: one severity filter + one or two attribute filters is plenty. Multi-clause filters are\nharder to reason about and rarely improve precision.",{"type":57,"tag":384,"props":543,"children":545},{"id":544},"_3-baseline-characterise-the-candidate-over-7-days",[546],{"type":62,"value":547},"3. Baseline — characterise the candidate over 7 days",{"type":57,"tag":65,"props":549,"children":550},{},[551,552,557,559,565,567,573],{"type":62,"value":394},{"type":57,"tag":127,"props":553,"children":555},{"className":554},[],[556],{"type":62,"value":258},{"type":62,"value":558}," with the candidate's filters, ",{"type":57,"tag":127,"props":560,"children":562},{"className":561},[],[563],{"type":62,"value":564},"dateRange: { date_from: \"-7d\" }",{"type":62,"value":566},", and\n",{"type":57,"tag":127,"props":568,"children":570},{"className":569},[],[571],{"type":62,"value":572},"targetBuckets: 24",{"type":62,"value":574}," (one bucket ≈ 7h). The response gives you bucket counts.",{"type":57,"tag":65,"props":576,"children":577},{},[578,583],{"type":57,"tag":349,"props":579,"children":580},{},[581],{"type":62,"value":582},"Do not eyeball the percentiles or scale the threshold to the alert window manually.",{"type":62,"value":584}," Pipe the\ncount-ranges response into the helper script:",{"type":57,"tag":586,"props":587,"children":592},"pre",{"className":588,"code":589,"language":590,"meta":591,"style":591},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","echo '\u003Ccount-ranges JSON>' | python3 scripts\u002Fbaseline_stats.py --window-minutes 5\n","bash","",[593],{"type":57,"tag":127,"props":594,"children":595},{"__ignoreMap":591},[596],{"type":57,"tag":597,"props":598,"children":601},"span",{"class":599,"line":600},"line",1,[602,608,614,620,625,630,636,641,646],{"type":57,"tag":597,"props":603,"children":605},{"style":604},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[606],{"type":62,"value":607},"echo",{"type":57,"tag":597,"props":609,"children":611},{"style":610},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[612],{"type":62,"value":613}," '",{"type":57,"tag":597,"props":615,"children":617},{"style":616},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[618],{"type":62,"value":619},"\u003Ccount-ranges JSON>",{"type":57,"tag":597,"props":621,"children":622},{"style":610},[623],{"type":62,"value":624},"'",{"type":57,"tag":597,"props":626,"children":627},{"style":610},[628],{"type":62,"value":629}," |",{"type":57,"tag":597,"props":631,"children":633},{"style":632},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[634],{"type":62,"value":635}," python3",{"type":57,"tag":597,"props":637,"children":638},{"style":616},[639],{"type":62,"value":640}," scripts\u002Fbaseline_stats.py",{"type":57,"tag":597,"props":642,"children":643},{"style":616},[644],{"type":62,"value":645}," --window-minutes",{"type":57,"tag":597,"props":647,"children":649},{"style":648},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[650],{"type":62,"value":651}," 5\n",{"type":57,"tag":65,"props":653,"children":654},{},[655],{"type":62,"value":656},"The script returns:",{"type":57,"tag":586,"props":658,"children":662},{"className":659,"code":660,"language":661,"meta":591,"style":591},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"n_buckets\": 12,\n  \"bucket_minutes\": 420.0,\n  \"alert_window_minutes\": 5,\n  \"stats\": { \"p50\": 12.0, \"p95\": 71.25, \"p99\": 126.25, \"max\": 140 },\n  \"suggested_threshold_count\": 5,\n  \"rationale\": \"max(p99=126.25, median*3=36.0, floor=5) scaled from 420m bucket to 5m window\",\n  \"health\": []\n}\n","json",[663],{"type":57,"tag":127,"props":664,"children":665},{"__ignoreMap":591},[666,674,709,739,769,902,931,969,995],{"type":57,"tag":597,"props":667,"children":668},{"class":599,"line":600},[669],{"type":57,"tag":597,"props":670,"children":671},{"style":610},[672],{"type":62,"value":673},"{\n",{"type":57,"tag":597,"props":675,"children":677},{"class":599,"line":676},2,[678,683,689,694,699,704],{"type":57,"tag":597,"props":679,"children":680},{"style":610},[681],{"type":62,"value":682},"  \"",{"type":57,"tag":597,"props":684,"children":686},{"style":685},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[687],{"type":62,"value":688},"n_buckets",{"type":57,"tag":597,"props":690,"children":691},{"style":610},[692],{"type":62,"value":693},"\"",{"type":57,"tag":597,"props":695,"children":696},{"style":610},[697],{"type":62,"value":698},":",{"type":57,"tag":597,"props":700,"children":701},{"style":648},[702],{"type":62,"value":703}," 12",{"type":57,"tag":597,"props":705,"children":706},{"style":610},[707],{"type":62,"value":708},",\n",{"type":57,"tag":597,"props":710,"children":712},{"class":599,"line":711},3,[713,717,722,726,730,735],{"type":57,"tag":597,"props":714,"children":715},{"style":610},[716],{"type":62,"value":682},{"type":57,"tag":597,"props":718,"children":719},{"style":685},[720],{"type":62,"value":721},"bucket_minutes",{"type":57,"tag":597,"props":723,"children":724},{"style":610},[725],{"type":62,"value":693},{"type":57,"tag":597,"props":727,"children":728},{"style":610},[729],{"type":62,"value":698},{"type":57,"tag":597,"props":731,"children":732},{"style":648},[733],{"type":62,"value":734}," 420.0",{"type":57,"tag":597,"props":736,"children":737},{"style":610},[738],{"type":62,"value":708},{"type":57,"tag":597,"props":740,"children":742},{"class":599,"line":741},4,[743,747,752,756,760,765],{"type":57,"tag":597,"props":744,"children":745},{"style":610},[746],{"type":62,"value":682},{"type":57,"tag":597,"props":748,"children":749},{"style":685},[750],{"type":62,"value":751},"alert_window_minutes",{"type":57,"tag":597,"props":753,"children":754},{"style":610},[755],{"type":62,"value":693},{"type":57,"tag":597,"props":757,"children":758},{"style":610},[759],{"type":62,"value":698},{"type":57,"tag":597,"props":761,"children":762},{"style":648},[763],{"type":62,"value":764}," 5",{"type":57,"tag":597,"props":766,"children":767},{"style":610},[768],{"type":62,"value":708},{"type":57,"tag":597,"props":770,"children":772},{"class":599,"line":771},5,[773,777,782,786,790,795,800,805,809,813,818,823,827,832,836,840,845,849,853,858,862,866,871,875,879,884,888,892,897],{"type":57,"tag":597,"props":774,"children":775},{"style":610},[776],{"type":62,"value":682},{"type":57,"tag":597,"props":778,"children":779},{"style":685},[780],{"type":62,"value":781},"stats",{"type":57,"tag":597,"props":783,"children":784},{"style":610},[785],{"type":62,"value":693},{"type":57,"tag":597,"props":787,"children":788},{"style":610},[789],{"type":62,"value":698},{"type":57,"tag":597,"props":791,"children":792},{"style":610},[793],{"type":62,"value":794}," {",{"type":57,"tag":597,"props":796,"children":797},{"style":610},[798],{"type":62,"value":799}," \"",{"type":57,"tag":597,"props":801,"children":802},{"style":632},[803],{"type":62,"value":804},"p50",{"type":57,"tag":597,"props":806,"children":807},{"style":610},[808],{"type":62,"value":693},{"type":57,"tag":597,"props":810,"children":811},{"style":610},[812],{"type":62,"value":698},{"type":57,"tag":597,"props":814,"children":815},{"style":648},[816],{"type":62,"value":817}," 12.0",{"type":57,"tag":597,"props":819,"children":820},{"style":610},[821],{"type":62,"value":822},",",{"type":57,"tag":597,"props":824,"children":825},{"style":610},[826],{"type":62,"value":799},{"type":57,"tag":597,"props":828,"children":829},{"style":632},[830],{"type":62,"value":831},"p95",{"type":57,"tag":597,"props":833,"children":834},{"style":610},[835],{"type":62,"value":693},{"type":57,"tag":597,"props":837,"children":838},{"style":610},[839],{"type":62,"value":698},{"type":57,"tag":597,"props":841,"children":842},{"style":648},[843],{"type":62,"value":844}," 71.25",{"type":57,"tag":597,"props":846,"children":847},{"style":610},[848],{"type":62,"value":822},{"type":57,"tag":597,"props":850,"children":851},{"style":610},[852],{"type":62,"value":799},{"type":57,"tag":597,"props":854,"children":855},{"style":632},[856],{"type":62,"value":857},"p99",{"type":57,"tag":597,"props":859,"children":860},{"style":610},[861],{"type":62,"value":693},{"type":57,"tag":597,"props":863,"children":864},{"style":610},[865],{"type":62,"value":698},{"type":57,"tag":597,"props":867,"children":868},{"style":648},[869],{"type":62,"value":870}," 126.25",{"type":57,"tag":597,"props":872,"children":873},{"style":610},[874],{"type":62,"value":822},{"type":57,"tag":597,"props":876,"children":877},{"style":610},[878],{"type":62,"value":799},{"type":57,"tag":597,"props":880,"children":881},{"style":632},[882],{"type":62,"value":883},"max",{"type":57,"tag":597,"props":885,"children":886},{"style":610},[887],{"type":62,"value":693},{"type":57,"tag":597,"props":889,"children":890},{"style":610},[891],{"type":62,"value":698},{"type":57,"tag":597,"props":893,"children":894},{"style":648},[895],{"type":62,"value":896}," 140",{"type":57,"tag":597,"props":898,"children":899},{"style":610},[900],{"type":62,"value":901}," },\n",{"type":57,"tag":597,"props":903,"children":905},{"class":599,"line":904},6,[906,910,915,919,923,927],{"type":57,"tag":597,"props":907,"children":908},{"style":610},[909],{"type":62,"value":682},{"type":57,"tag":597,"props":911,"children":912},{"style":685},[913],{"type":62,"value":914},"suggested_threshold_count",{"type":57,"tag":597,"props":916,"children":917},{"style":610},[918],{"type":62,"value":693},{"type":57,"tag":597,"props":920,"children":921},{"style":610},[922],{"type":62,"value":698},{"type":57,"tag":597,"props":924,"children":925},{"style":648},[926],{"type":62,"value":764},{"type":57,"tag":597,"props":928,"children":929},{"style":610},[930],{"type":62,"value":708},{"type":57,"tag":597,"props":932,"children":934},{"class":599,"line":933},7,[935,939,944,948,952,956,961,965],{"type":57,"tag":597,"props":936,"children":937},{"style":610},[938],{"type":62,"value":682},{"type":57,"tag":597,"props":940,"children":941},{"style":685},[942],{"type":62,"value":943},"rationale",{"type":57,"tag":597,"props":945,"children":946},{"style":610},[947],{"type":62,"value":693},{"type":57,"tag":597,"props":949,"children":950},{"style":610},[951],{"type":62,"value":698},{"type":57,"tag":597,"props":953,"children":954},{"style":610},[955],{"type":62,"value":799},{"type":57,"tag":597,"props":957,"children":958},{"style":616},[959],{"type":62,"value":960},"max(p99=126.25, median*3=36.0, floor=5) scaled from 420m bucket to 5m window",{"type":57,"tag":597,"props":962,"children":963},{"style":610},[964],{"type":62,"value":693},{"type":57,"tag":597,"props":966,"children":967},{"style":610},[968],{"type":62,"value":708},{"type":57,"tag":597,"props":970,"children":972},{"class":599,"line":971},8,[973,977,982,986,990],{"type":57,"tag":597,"props":974,"children":975},{"style":610},[976],{"type":62,"value":682},{"type":57,"tag":597,"props":978,"children":979},{"style":685},[980],{"type":62,"value":981},"health",{"type":57,"tag":597,"props":983,"children":984},{"style":610},[985],{"type":62,"value":693},{"type":57,"tag":597,"props":987,"children":988},{"style":610},[989],{"type":62,"value":698},{"type":57,"tag":597,"props":991,"children":992},{"style":610},[993],{"type":62,"value":994}," []\n",{"type":57,"tag":597,"props":996,"children":998},{"class":599,"line":997},9,[999],{"type":57,"tag":597,"props":1000,"children":1001},{"style":610},[1002],{"type":62,"value":1003},"}\n",{"type":57,"tag":65,"props":1005,"children":1006},{},[1007,1009,1014,1016,1021],{"type":62,"value":1008},"Use ",{"type":57,"tag":127,"props":1010,"children":1012},{"className":1011},[],[1013],{"type":62,"value":914},{"type":62,"value":1015}," as your starting threshold. Read ",{"type":57,"tag":127,"props":1017,"children":1019},{"className":1018},[],[1020],{"type":62,"value":981},{"type":62,"value":698},{"type":57,"tag":163,"props":1023,"children":1024},{},[1025,1051],{"type":57,"tag":167,"props":1026,"children":1027},{},[1028],{"type":57,"tag":171,"props":1029,"children":1030},{},[1031,1041,1046],{"type":57,"tag":175,"props":1032,"children":1033},{},[1034,1039],{"type":57,"tag":127,"props":1035,"children":1037},{"className":1036},[],[1038],{"type":62,"value":981},{"type":62,"value":1040}," flag",{"type":57,"tag":175,"props":1042,"children":1043},{},[1044],{"type":62,"value":1045},"What it means",{"type":57,"tag":175,"props":1047,"children":1048},{},[1049],{"type":62,"value":1050},"What to do",{"type":57,"tag":191,"props":1052,"children":1053},{},[1054,1084,1106,1139,1172],{"type":57,"tag":171,"props":1055,"children":1056},{},[1057,1066,1071],{"type":57,"tag":198,"props":1058,"children":1059},{},[1060],{"type":57,"tag":127,"props":1061,"children":1063},{"className":1062},[],[1064],{"type":62,"value":1065},"sparse:N_of_M_buckets",{"type":57,"tag":198,"props":1067,"children":1068},{},[1069],{"type":62,"value":1070},"Too few non-empty buckets for a 7d baseline.",{"type":57,"tag":198,"props":1072,"children":1073},{},[1074,1076,1082],{"type":62,"value":1075},"Widen filter, extend to ",{"type":57,"tag":127,"props":1077,"children":1079},{"className":1078},[],[1080],{"type":62,"value":1081},"-30d",{"type":62,"value":1083},", or skip.",{"type":57,"tag":171,"props":1085,"children":1086},{},[1087,1096,1101],{"type":57,"tag":198,"props":1088,"children":1089},{},[1090],{"type":57,"tag":127,"props":1091,"children":1093},{"className":1092},[],[1094],{"type":62,"value":1095},"empty",{"type":57,"tag":198,"props":1097,"children":1098},{},[1099],{"type":62,"value":1100},"All buckets are zero.",{"type":57,"tag":198,"props":1102,"children":1103},{},[1104],{"type":62,"value":1105},"Skip — no signal.",{"type":57,"tag":171,"props":1107,"children":1108},{},[1109,1118,1134],{"type":57,"tag":198,"props":1110,"children":1111},{},[1112],{"type":57,"tag":127,"props":1113,"children":1115},{"className":1114},[],[1116],{"type":62,"value":1117},"spiky",{"type":57,"tag":198,"props":1119,"children":1120},{},[1121,1126,1128,1133],{"type":57,"tag":127,"props":1122,"children":1124},{"className":1123},[],[1125],{"type":62,"value":883},{"type":62,"value":1127}," is 10×+ ",{"type":57,"tag":127,"props":1129,"children":1131},{"className":1130},[],[1132],{"type":62,"value":831},{"type":62,"value":475},{"type":57,"tag":198,"props":1135,"children":1136},{},[1137],{"type":62,"value":1138},"Count-threshold alerts work well. Proceed.",{"type":57,"tag":171,"props":1140,"children":1141},{},[1142,1151,1167],{"type":57,"tag":198,"props":1143,"children":1144},{},[1145],{"type":57,"tag":127,"props":1146,"children":1148},{"className":1147},[],[1149],{"type":62,"value":1150},"flat",{"type":57,"tag":198,"props":1152,"children":1153},{},[1154,1159,1161,1166],{"type":57,"tag":127,"props":1155,"children":1157},{"className":1156},[],[1158],{"type":62,"value":831},{"type":62,"value":1160}," ≈ ",{"type":57,"tag":127,"props":1162,"children":1164},{"className":1163},[],[1165],{"type":62,"value":804},{"type":62,"value":475},{"type":57,"tag":198,"props":1168,"children":1169},{},[1170],{"type":62,"value":1171},"Be cautious — either no incidents in lookback, or the metric is too smooth. Try a longer lookback or skip.",{"type":57,"tag":171,"props":1173,"children":1174},{},[1175,1186,1191],{"type":57,"tag":198,"props":1176,"children":1177},{},[1178,1184],{"type":57,"tag":127,"props":1179,"children":1181},{"className":1180},[],[1182],{"type":62,"value":1183},"[]",{"type":62,"value":1185}," (empty)",{"type":57,"tag":198,"props":1187,"children":1188},{},[1189],{"type":62,"value":1190},"Healthy distribution.",{"type":57,"tag":198,"props":1192,"children":1193},{},[1194],{"type":62,"value":1195},"Proceed.",{"type":57,"tag":384,"props":1197,"children":1199},{"id":1198},"_4-draft-and-simulate",[1200],{"type":62,"value":1201},"4. Draft and simulate",{"type":57,"tag":65,"props":1203,"children":1204},{},[1205,1207,1213],{"type":62,"value":1206},"Pick a starter draft from these defaults — see ",{"type":57,"tag":468,"props":1208,"children":1210},{"href":1209},".\u002Freferences\u002Fthreshold-defaults.md",[1211],{"type":62,"value":1212},"references\u002Fthreshold-defaults.md",{"type":62,"value":1214},"\nfor the reasoning:",{"type":57,"tag":163,"props":1216,"children":1217},{},[1218,1239],{"type":57,"tag":167,"props":1219,"children":1220},{},[1221],{"type":57,"tag":171,"props":1222,"children":1223},{},[1224,1229,1234],{"type":57,"tag":175,"props":1225,"children":1226},{},[1227],{"type":62,"value":1228},"Setting",{"type":57,"tag":175,"props":1230,"children":1231},{},[1232],{"type":62,"value":1233},"Default",{"type":57,"tag":175,"props":1235,"children":1236},{},[1237],{"type":62,"value":1238},"Notes",{"type":57,"tag":191,"props":1240,"children":1241},{},[1242,1269,1302,1328,1354,1380],{"type":57,"tag":171,"props":1243,"children":1244},{},[1245,1254,1264],{"type":57,"tag":198,"props":1246,"children":1247},{},[1248],{"type":57,"tag":127,"props":1249,"children":1251},{"className":1250},[],[1252],{"type":62,"value":1253},"threshold_count",{"type":57,"tag":198,"props":1255,"children":1256},{},[1257,1262],{"type":57,"tag":127,"props":1258,"children":1260},{"className":1259},[],[1261],{"type":62,"value":914},{"type":62,"value":1263}," from the script",{"type":57,"tag":198,"props":1265,"children":1266},{},[1267],{"type":62,"value":1268},"Already scaled to the alert window.",{"type":57,"tag":171,"props":1270,"children":1271},{},[1272,1281,1290],{"type":57,"tag":198,"props":1273,"children":1274},{},[1275],{"type":57,"tag":127,"props":1276,"children":1278},{"className":1277},[],[1279],{"type":62,"value":1280},"threshold_operator",{"type":57,"tag":198,"props":1282,"children":1283},{},[1284],{"type":57,"tag":127,"props":1285,"children":1287},{"className":1286},[],[1288],{"type":62,"value":1289},"above",{"type":57,"tag":198,"props":1291,"children":1292},{},[1293,1294,1300],{"type":62,"value":1008},{"type":57,"tag":127,"props":1295,"children":1297},{"className":1296},[],[1298],{"type":62,"value":1299},"below",{"type":62,"value":1301}," only for volume-floor alerts.",{"type":57,"tag":171,"props":1303,"children":1304},{},[1305,1314,1323],{"type":57,"tag":198,"props":1306,"children":1307},{},[1308],{"type":57,"tag":127,"props":1309,"children":1311},{"className":1310},[],[1312],{"type":62,"value":1313},"window_minutes",{"type":57,"tag":198,"props":1315,"children":1316},{},[1317],{"type":57,"tag":127,"props":1318,"children":1320},{"className":1319},[],[1321],{"type":62,"value":1322},"5",{"type":57,"tag":198,"props":1324,"children":1325},{},[1326],{"type":62,"value":1327},"Allowed: 5, 10, 15, 30, 60. Must match what you passed to the script.",{"type":57,"tag":171,"props":1329,"children":1330},{},[1331,1340,1349],{"type":57,"tag":198,"props":1332,"children":1333},{},[1334],{"type":57,"tag":127,"props":1335,"children":1337},{"className":1336},[],[1338],{"type":62,"value":1339},"evaluation_periods",{"type":57,"tag":198,"props":1341,"children":1342},{},[1343],{"type":57,"tag":127,"props":1344,"children":1346},{"className":1345},[],[1347],{"type":62,"value":1348},"3",{"type":57,"tag":198,"props":1350,"children":1351},{},[1352],{"type":62,"value":1353},"M in N-of-M.",{"type":57,"tag":171,"props":1355,"children":1356},{},[1357,1366,1375],{"type":57,"tag":198,"props":1358,"children":1359},{},[1360],{"type":57,"tag":127,"props":1361,"children":1363},{"className":1362},[],[1364],{"type":62,"value":1365},"datapoints_to_alarm",{"type":57,"tag":198,"props":1367,"children":1368},{},[1369],{"type":57,"tag":127,"props":1370,"children":1372},{"className":1371},[],[1373],{"type":62,"value":1374},"2",{"type":57,"tag":198,"props":1376,"children":1377},{},[1378],{"type":62,"value":1379},"N in N-of-M. 2-of-3 reduces flap from a single noisy bucket.",{"type":57,"tag":171,"props":1381,"children":1382},{},[1383,1392,1401],{"type":57,"tag":198,"props":1384,"children":1385},{},[1386],{"type":57,"tag":127,"props":1387,"children":1389},{"className":1388},[],[1390],{"type":62,"value":1391},"cooldown_minutes",{"type":57,"tag":198,"props":1393,"children":1394},{},[1395],{"type":57,"tag":127,"props":1396,"children":1398},{"className":1397},[],[1399],{"type":62,"value":1400},"30",{"type":57,"tag":198,"props":1402,"children":1403},{},[1404],{"type":62,"value":1405},"Minimum time between repeat fires.",{"type":57,"tag":65,"props":1407,"children":1408},{},[1409,1410,1415,1417,1423,1425,1431,1433,1439],{"type":62,"value":394},{"type":57,"tag":127,"props":1411,"children":1413},{"className":1412},[],[1414],{"type":62,"value":280},{"type":62,"value":1416}," with these settings and ",{"type":57,"tag":127,"props":1418,"children":1420},{"className":1419},[],[1421],{"type":62,"value":1422},"date_from: \"-7d\"",{"type":62,"value":1424},". The response gives you ",{"type":57,"tag":127,"props":1426,"children":1428},{"className":1427},[],[1429],{"type":62,"value":1430},"fire_count",{"type":62,"value":1432},"\nand ",{"type":57,"tag":127,"props":1434,"children":1436},{"className":1435},[],[1437],{"type":62,"value":1438},"resolve_count",{"type":62,"value":475},{"type":57,"tag":384,"props":1441,"children":1443},{"id":1442},"_5-iterate-three-rounds-then-ship-or-skip",[1444],{"type":62,"value":1445},"5. Iterate — three rounds, then ship or skip",{"type":57,"tag":65,"props":1447,"children":1448},{},[1449,1451,1456,1458,1463],{"type":62,"value":1450},"Target: ",{"type":57,"tag":127,"props":1452,"children":1454},{"className":1453},[],[1455],{"type":62,"value":1430},{"type":62,"value":1457}," between 0 and ~3 over ",{"type":57,"tag":127,"props":1459,"children":1461},{"className":1460},[],[1462],{"type":62,"value":291},{"type":62,"value":1464},". If outside the band:",{"type":57,"tag":163,"props":1466,"children":1467},{},[1468,1484],{"type":57,"tag":167,"props":1469,"children":1470},{},[1471],{"type":57,"tag":171,"props":1472,"children":1473},{},[1474,1479],{"type":57,"tag":175,"props":1475,"children":1476},{},[1477],{"type":62,"value":1478},"Outcome",{"type":57,"tag":175,"props":1480,"children":1481},{},[1482],{"type":62,"value":1483},"Adjustment",{"type":57,"tag":191,"props":1485,"children":1486},{},[1487,1527,1551,1583],{"type":57,"tag":171,"props":1488,"children":1489},{},[1490,1507],{"type":57,"tag":198,"props":1491,"children":1492},{},[1493,1498,1500,1505],{"type":57,"tag":127,"props":1494,"children":1496},{"className":1495},[],[1497],{"type":62,"value":1430},{"type":62,"value":1499}," = 0 over 7d ",{"type":57,"tag":71,"props":1501,"children":1502},{},[1503],{"type":62,"value":1504},"and",{"type":62,"value":1506}," the baseline was spiky",{"type":57,"tag":198,"props":1508,"children":1509},{},[1510,1512,1517,1519,1525],{"type":62,"value":1511},"Lower ",{"type":57,"tag":127,"props":1513,"children":1515},{"className":1514},[],[1516],{"type":62,"value":1253},{"type":62,"value":1518}," toward ",{"type":57,"tag":127,"props":1520,"children":1522},{"className":1521},[],[1523],{"type":62,"value":1524},"stats.p95",{"type":62,"value":1526}," from the script, or drop to 1-of-2.",{"type":57,"tag":171,"props":1528,"children":1529},{},[1530,1546],{"type":57,"tag":198,"props":1531,"children":1532},{},[1533,1538,1540,1544],{"type":57,"tag":127,"props":1534,"children":1536},{"className":1535},[],[1537],{"type":62,"value":1430},{"type":62,"value":1539}," = 0 ",{"type":57,"tag":71,"props":1541,"children":1542},{},[1543],{"type":62,"value":1504},{"type":62,"value":1545}," the baseline was flat",{"type":57,"tag":198,"props":1547,"children":1548},{},[1549],{"type":62,"value":1550},"The service has no alertable signal. Skip it; log why.",{"type":57,"tag":171,"props":1552,"children":1553},{},[1554,1564],{"type":57,"tag":198,"props":1555,"children":1556},{},[1557,1562],{"type":57,"tag":127,"props":1558,"children":1560},{"className":1559},[],[1561],{"type":62,"value":1430},{"type":62,"value":1563}," > 5",{"type":57,"tag":198,"props":1565,"children":1566},{},[1567,1569,1574,1575,1581],{"type":62,"value":1568},"Raise ",{"type":57,"tag":127,"props":1570,"children":1572},{"className":1571},[],[1573],{"type":62,"value":1253},{"type":62,"value":1518},{"type":57,"tag":127,"props":1576,"children":1578},{"className":1577},[],[1579],{"type":62,"value":1580},"stats.max",{"type":62,"value":1582}," from the script, or move to 3-of-5 for a smoother window.",{"type":57,"tag":171,"props":1584,"children":1585},{},[1586,1596],{"type":57,"tag":198,"props":1587,"children":1588},{},[1589,1594],{"type":57,"tag":127,"props":1590,"children":1592},{"className":1591},[],[1593],{"type":62,"value":1430},{"type":62,"value":1595}," is fine but resolve_count never matches fire_count",{"type":57,"tag":198,"props":1597,"children":1598},{},[1599],{"type":62,"value":1600},"Cooldown is too long, or the underlying state is genuinely sticky. Acceptable for now.",{"type":57,"tag":65,"props":1602,"children":1603},{},[1604,1606],{"type":62,"value":1605},"When adjusting the threshold, ",{"type":57,"tag":349,"props":1607,"children":1608},{},[1609,1611,1616],{"type":62,"value":1610},"read values from the script's ",{"type":57,"tag":127,"props":1612,"children":1614},{"className":1613},[],[1615],{"type":62,"value":781},{"type":62,"value":1617}," block — never recompute percentiles\nby hand.",{"type":57,"tag":65,"props":1619,"children":1620},{},[1621,1623,1628],{"type":62,"value":1622},"Cap iteration at ",{"type":57,"tag":349,"props":1624,"children":1625},{},[1626],{"type":62,"value":1627},"3 simulate calls per candidate",{"type":62,"value":1629},". If you can't land in the band in 3 rounds, the metric\nis wrong — either the filter is too broad, the window is wrong, or the service genuinely doesn't have a\nthreshold-shape signal. Note it and move on.",{"type":57,"tag":384,"props":1631,"children":1633},{"id":1632},"_6-ship-create-attach-destination",[1634],{"type":62,"value":1635},"6. Ship — create + attach destination",{"type":57,"tag":65,"props":1637,"children":1638},{},[1639],{"type":62,"value":1640},"Once a draft simulates cleanly:",{"type":57,"tag":1642,"props":1643,"children":1644},"ol",{},[1645,1664],{"type":57,"tag":90,"props":1646,"children":1647},{},[1648,1649,1654,1656,1662],{"type":62,"value":394},{"type":57,"tag":127,"props":1650,"children":1652},{"className":1651},[],[1653],{"type":62,"value":310},{"type":62,"value":1655}," with the validated config. Use a name like ",{"type":57,"tag":127,"props":1657,"children":1659},{"className":1658},[],[1660],{"type":62,"value":1661},"\u003Cservice> error rate (auto)",{"type":62,"value":1663}," so the\nuser can see at a glance which alerts came from this skill.",{"type":57,"tag":90,"props":1665,"children":1666},{},[1667,1668,1673,1675,1680,1682,1759,1763],{"type":62,"value":394},{"type":57,"tag":127,"props":1669,"children":1671},{"className":1670},[],[1672],{"type":62,"value":332},{"type":62,"value":1674}," to wire it to a notification target. ",{"type":57,"tag":349,"props":1676,"children":1677},{},[1678],{"type":62,"value":1679},"An alert with no destination\nis silent.",{"type":62,"value":1681}," Supported destination fields:",{"type":57,"tag":86,"props":1683,"children":1684},{},[1685,1721,1741],{"type":57,"tag":90,"props":1686,"children":1687},{},[1688,1690,1696,1697,1703,1705,1711,1713,1719],{"type":62,"value":1689},"Slack: ",{"type":57,"tag":127,"props":1691,"children":1693},{"className":1692},[],[1694],{"type":62,"value":1695},"type: \"slack\"",{"type":62,"value":521},{"type":57,"tag":127,"props":1698,"children":1700},{"className":1699},[],[1701],{"type":62,"value":1702},"slack_workspace_id",{"type":62,"value":1704},", and ",{"type":57,"tag":127,"props":1706,"children":1708},{"className":1707},[],[1709],{"type":62,"value":1710},"slack_channel_id",{"type":62,"value":1712},". ",{"type":57,"tag":127,"props":1714,"children":1716},{"className":1715},[],[1717],{"type":62,"value":1718},"slack_channel_name",{"type":62,"value":1720}," is optional.",{"type":57,"tag":90,"props":1722,"children":1723},{},[1724,1726,1732,1734,1740],{"type":62,"value":1725},"Webhook: ",{"type":57,"tag":127,"props":1727,"children":1729},{"className":1728},[],[1730],{"type":62,"value":1731},"type: \"webhook\"",{"type":62,"value":1733}," and ",{"type":57,"tag":127,"props":1735,"children":1737},{"className":1736},[],[1738],{"type":62,"value":1739},"webhook_url",{"type":62,"value":475},{"type":57,"tag":90,"props":1742,"children":1743},{},[1744,1746,1752,1753,1758],{"type":62,"value":1745},"Microsoft Teams: ",{"type":57,"tag":127,"props":1747,"children":1749},{"className":1748},[],[1750],{"type":62,"value":1751},"type: \"teams\"",{"type":62,"value":1733},{"type":57,"tag":127,"props":1754,"children":1756},{"className":1755},[],[1757],{"type":62,"value":1739},{"type":62,"value":475},{"type":57,"tag":1760,"props":1761,"children":1762},"br",{},[],{"type":62,"value":1764},"Always confirm the channel name or webhook URL with the user before attaching. Never wire\nan auto-generated alert to a production channel without explicit confirmation. If the user is unsure,\nsuggest a low-traffic testing channel for the first few alerts.",{"type":57,"tag":65,"props":1766,"children":1767},{},[1768,1770,1776,1778,1783,1785,1791],{"type":62,"value":1769},"If the user wants alerts created in ",{"type":57,"tag":127,"props":1771,"children":1773},{"className":1772},[],[1774],{"type":62,"value":1775},"enabled: false",{"type":62,"value":1777}," state for review-then-flip, pass ",{"type":57,"tag":127,"props":1779,"children":1781},{"className":1780},[],[1782],{"type":62,"value":1775},{"type":62,"value":1784}," to\n",{"type":57,"tag":127,"props":1786,"children":1788},{"className":1787},[],[1789],{"type":62,"value":1790},"-create",{"type":62,"value":1792}," and tell them how many drafts you produced.",{"type":57,"tag":79,"props":1794,"children":1796},{"id":1795},"filter-shape-required",[1797],{"type":62,"value":1798},"Filter shape — required",{"type":57,"tag":65,"props":1800,"children":1801},{},[1802,1804,1810,1812,1817,1819,1825,1826,1831],{"type":62,"value":1803},"The ",{"type":57,"tag":127,"props":1805,"children":1807},{"className":1806},[],[1808],{"type":62,"value":1809},"filters",{"type":62,"value":1811}," field on ",{"type":57,"tag":127,"props":1813,"children":1815},{"className":1814},[],[1816],{"type":62,"value":310},{"type":62,"value":1818}," takes a subset of ",{"type":57,"tag":127,"props":1820,"children":1822},{"className":1821},[],[1823],{"type":62,"value":1824},"LogsViewerFilters",{"type":62,"value":1733},{"type":57,"tag":349,"props":1827,"children":1828},{},[1829],{"type":62,"value":1830},"must contain at\nleast one of",{"type":62,"value":698},{"type":57,"tag":86,"props":1833,"children":1834},{},[1835,1852,1863],{"type":57,"tag":90,"props":1836,"children":1837},{},[1838,1844,1846],{"type":57,"tag":127,"props":1839,"children":1841},{"className":1840},[],[1842],{"type":62,"value":1843},"severityLevels",{"type":62,"value":1845}," — list of ",{"type":57,"tag":127,"props":1847,"children":1849},{"className":1848},[],[1850],{"type":62,"value":1851},"[\"trace\",\"debug\",\"info\",\"warn\",\"error\",\"fatal\"]",{"type":57,"tag":90,"props":1853,"children":1854},{},[1855,1861],{"type":57,"tag":127,"props":1856,"children":1858},{"className":1857},[],[1859],{"type":62,"value":1860},"serviceNames",{"type":62,"value":1862}," — list of service name strings",{"type":57,"tag":90,"props":1864,"children":1865},{},[1866,1872],{"type":57,"tag":127,"props":1867,"children":1869},{"className":1868},[],[1870],{"type":62,"value":1871},"filterGroup",{"type":62,"value":1873}," — property filter group",{"type":57,"tag":65,"props":1875,"children":1876},{},[1877,1879,1884,1886,1891],{"type":62,"value":1878},"The same shape goes into ",{"type":57,"tag":127,"props":1880,"children":1882},{"className":1881},[],[1883],{"type":62,"value":280},{"type":62,"value":1885},"'s ",{"type":57,"tag":127,"props":1887,"children":1889},{"className":1888},[],[1890],{"type":62,"value":1809},{"type":62,"value":1892}," field. Match the simulate filters to the alert filters\nexactly — otherwise the simulation is testing a different alert than the one you ship.",{"type":57,"tag":65,"props":1894,"children":1895},{},[1896],{"type":62,"value":1897},"Example minimum:",{"type":57,"tag":586,"props":1899,"children":1901},{"className":659,"code":1900,"language":661,"meta":591,"style":591},"{\n  \"severityLevels\": [\"error\", \"fatal\"],\n  \"serviceNames\": [\"api-gateway\"]\n}\n",[1902],{"type":57,"tag":127,"props":1903,"children":1904},{"__ignoreMap":591},[1905,1912,1971,2012],{"type":57,"tag":597,"props":1906,"children":1907},{"class":599,"line":600},[1908],{"type":57,"tag":597,"props":1909,"children":1910},{"style":610},[1911],{"type":62,"value":673},{"type":57,"tag":597,"props":1913,"children":1914},{"class":599,"line":676},[1915,1919,1923,1927,1931,1936,1940,1945,1949,1953,1957,1962,1966],{"type":57,"tag":597,"props":1916,"children":1917},{"style":610},[1918],{"type":62,"value":682},{"type":57,"tag":597,"props":1920,"children":1921},{"style":685},[1922],{"type":62,"value":1843},{"type":57,"tag":597,"props":1924,"children":1925},{"style":610},[1926],{"type":62,"value":693},{"type":57,"tag":597,"props":1928,"children":1929},{"style":610},[1930],{"type":62,"value":698},{"type":57,"tag":597,"props":1932,"children":1933},{"style":610},[1934],{"type":62,"value":1935}," [",{"type":57,"tag":597,"props":1937,"children":1938},{"style":610},[1939],{"type":62,"value":693},{"type":57,"tag":597,"props":1941,"children":1942},{"style":616},[1943],{"type":62,"value":1944},"error",{"type":57,"tag":597,"props":1946,"children":1947},{"style":610},[1948],{"type":62,"value":693},{"type":57,"tag":597,"props":1950,"children":1951},{"style":610},[1952],{"type":62,"value":822},{"type":57,"tag":597,"props":1954,"children":1955},{"style":610},[1956],{"type":62,"value":799},{"type":57,"tag":597,"props":1958,"children":1959},{"style":616},[1960],{"type":62,"value":1961},"fatal",{"type":57,"tag":597,"props":1963,"children":1964},{"style":610},[1965],{"type":62,"value":693},{"type":57,"tag":597,"props":1967,"children":1968},{"style":610},[1969],{"type":62,"value":1970},"],\n",{"type":57,"tag":597,"props":1972,"children":1973},{"class":599,"line":711},[1974,1978,1982,1986,1990,1994,1998,2003,2007],{"type":57,"tag":597,"props":1975,"children":1976},{"style":610},[1977],{"type":62,"value":682},{"type":57,"tag":597,"props":1979,"children":1980},{"style":685},[1981],{"type":62,"value":1860},{"type":57,"tag":597,"props":1983,"children":1984},{"style":610},[1985],{"type":62,"value":693},{"type":57,"tag":597,"props":1987,"children":1988},{"style":610},[1989],{"type":62,"value":698},{"type":57,"tag":597,"props":1991,"children":1992},{"style":610},[1993],{"type":62,"value":1935},{"type":57,"tag":597,"props":1995,"children":1996},{"style":610},[1997],{"type":62,"value":693},{"type":57,"tag":597,"props":1999,"children":2000},{"style":616},[2001],{"type":62,"value":2002},"api-gateway",{"type":57,"tag":597,"props":2004,"children":2005},{"style":610},[2006],{"type":62,"value":693},{"type":57,"tag":597,"props":2008,"children":2009},{"style":610},[2010],{"type":62,"value":2011},"]\n",{"type":57,"tag":597,"props":2013,"children":2014},{"class":599,"line":741},[2015],{"type":57,"tag":597,"props":2016,"children":2017},{"style":610},[2018],{"type":62,"value":1003},{"type":57,"tag":79,"props":2020,"children":2022},{"id":2021},"token-economy-rules",[2023],{"type":62,"value":2024},"Token-economy rules",{"type":57,"tag":86,"props":2026,"children":2027},{},[2028,2040,2058,2070,2082],{"type":57,"tag":90,"props":2029,"children":2030},{},[2031,2033,2038],{"type":62,"value":2032},"One ",{"type":57,"tag":127,"props":2034,"children":2036},{"className":2035},[],[2037],{"type":62,"value":206},{"type":62,"value":2039}," call at the start, not per-candidate.",{"type":57,"tag":90,"props":2041,"children":2042},{},[2043,2044,2049,2051,2056],{"type":62,"value":2032},{"type":57,"tag":127,"props":2045,"children":2047},{"className":2046},[],[2048],{"type":62,"value":258},{"type":62,"value":2050}," call per candidate at ",{"type":57,"tag":127,"props":2052,"children":2054},{"className":2053},[],[2055],{"type":62,"value":572},{"type":62,"value":2057},". Don't go above 30 during authoring.",{"type":57,"tag":90,"props":2059,"children":2060},{},[2061,2063,2068],{"type":62,"value":2062},"≤ 3 ",{"type":57,"tag":127,"props":2064,"children":2066},{"className":2065},[],[2067],{"type":62,"value":280},{"type":62,"value":2069}," calls per candidate.",{"type":57,"tag":90,"props":2071,"children":2072},{},[2073,2075,2080],{"type":62,"value":2074},"Zero ",{"type":57,"tag":127,"props":2076,"children":2078},{"className":2077},[],[2079],{"type":62,"value":153},{"type":62,"value":2081}," calls during the authoring loop.",{"type":57,"tag":90,"props":2083,"children":2084},{},[2085],{"type":62,"value":2086},"Prefer reporting a small set of well-validated alerts over a long list of unvalidated drafts.",{"type":57,"tag":79,"props":2088,"children":2090},{"id":2089},"output",[2091],{"type":62,"value":2092},"Output",{"type":57,"tag":65,"props":2094,"children":2095},{},[2096],{"type":62,"value":2097},"Report what you did, in this shape:",{"type":57,"tag":86,"props":2099,"children":2100},{},[2101,2106,2111],{"type":57,"tag":90,"props":2102,"children":2103},{},[2104],{"type":62,"value":2105},"For each shipped alert: name, filters, threshold, simulated fire_count over 7d, destination.",{"type":57,"tag":90,"props":2107,"children":2108},{},[2109],{"type":62,"value":2110},"For each skipped candidate: service name + why (flat baseline, can't land threshold, low volume).",{"type":57,"tag":90,"props":2112,"children":2113},{},[2114],{"type":62,"value":2115},"Total simulate calls made, total alerts created.",{"type":57,"tag":65,"props":2117,"children":2118},{},[2119],{"type":62,"value":2120},"The user should be able to read this and decide whether to disable any drafts before they go live.",{"type":57,"tag":2122,"props":2123,"children":2124},"style",{},[2125],{"type":62,"value":2126},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":2128,"total":2286},[2129,2142,2154,2166,2179,2194,2202,2219,2233,2248,2258,2276],{"slug":2130,"name":2130,"fn":2131,"description":2132,"org":2133,"tags":2134,"stars":26,"repoUrl":27,"updatedAt":2141},"analyzing-expensive-users","analyze expensive users in AI observability","Analyze the most expensive users in AI observability and explain why they cost so much. Use when the user asks about top spenders, expensive users, per-user LLM cost, user-level cost drivers, or patterns behind high AI observability spend.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2135,2136,2139,2140],{"name":24,"slug":25,"type":15},{"name":2137,"slug":2138,"type":15},"Cost Optimization","cost-optimization",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-07-28T05:34:11.117757",{"slug":2143,"name":2143,"fn":2144,"description":2145,"org":2146,"tags":2147,"stars":26,"repoUrl":27,"updatedAt":2153},"auditing-endpoints","audit PostHog project endpoints","Audit every endpoint in a PostHog project for staleness, failed materialisations, and unused materialised versions. Use when the user asks \"what endpoints can I clean up?\", \"are any of my endpoints broken?\", \"which materialised versions are still being called?\", or wants a one-shot cleanup pass over the Endpoints product. Produces a prioritised report grouped by issue type, with recommended actions but does not modify anything without explicit confirmation.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2148,2149,2152],{"name":24,"slug":25,"type":15},{"name":2150,"slug":2151,"type":15},"Audit","audit",{"name":9,"slug":8,"type":15},"2026-06-08T08:08:33.693989",{"slug":2155,"name":2155,"fn":2156,"description":2157,"org":2158,"tags":2159,"stars":26,"repoUrl":27,"updatedAt":2165},"auditing-warehouse-source-health","audit PostHog data warehouse source health","Audit the health of a PostHog project's data warehouse sources and syncs — find every broken or degraded source connection, sync schema, and webhook channel. Use when the user asks \"why are my imports failing?\", \"what's broken with my sources?\", \"why is my warehouse data stale?\", or wants a one-shot triage of source\u002Fsync health before deciding where to dig in. Produces a prioritized report grouped by severity, with recommended next steps. For materialized-view health use `auditing-warehouse-view-health`; for a single failing sync use `diagnosing-failed-warehouse-syncs`.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2160,2161,2163,2164],{"name":2150,"slug":2151,"type":15},{"name":2162,"slug":35,"type":15},"Data Warehouse",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-06-18T08:22:57.67984",{"slug":2167,"name":2167,"fn":2168,"description":2169,"org":2170,"tags":2171,"stars":26,"repoUrl":27,"updatedAt":2178},"auditing-warehouse-view-health","audit PostHog materialized view health","Audit the health of a PostHog project's materialized views (saved queries) — find every failed materialization and flag unused or stale materialized views that cost storage and compute. Use when the user asks \"which of my views are broken?\", \"why is this materialized view failing?\", \"are any of my views wasting compute?\", or wants a one-shot triage of view health. For source\u002Fsync health use `auditing-warehouse-source-health`.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2172,2173,2174,2177],{"name":2150,"slug":2151,"type":15},{"name":2162,"slug":35,"type":15},{"name":2175,"slug":2176,"type":15},"Performance","performance",{"name":9,"slug":8,"type":15},"2026-06-18T08:25:10.936787",{"slug":2180,"name":2180,"fn":2181,"description":2182,"org":2183,"tags":2184,"stars":26,"repoUrl":27,"updatedAt":2193},"authoring-error-tracking-alerts","author PostHog error tracking alerts","Author error tracking alerts that fire when an issue is created, reopened, or starts spiking. Use when the user asks to set up error notifications, route exceptions to Slack\u002Fwebhook\u002FLinear, or evaluate which error events are worth alerting on. Covers trigger-event selection, integration choice, dedup against existing alerts, and shipping with the canonical message body shape.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2185,2188,2191,2192],{"name":2186,"slug":2187,"type":15},"Alerting","alerting",{"name":2189,"slug":2190,"type":15},"Debugging","debugging",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-06-18T08:24:40.318583",{"slug":4,"name":4,"fn":5,"description":6,"org":2195,"tags":2196,"stars":26,"repoUrl":27,"updatedAt":28},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2197,2198,2199,2200,2201],{"name":24,"slug":25,"type":15},{"name":21,"slug":22,"type":15},{"name":13,"slug":14,"type":15},{"name":17,"slug":18,"type":15},{"name":9,"slug":8,"type":15},{"slug":2203,"name":2203,"fn":2204,"description":2205,"org":2206,"tags":2207,"stars":26,"repoUrl":27,"updatedAt":2218},"building-workflows","build and edit PostHog workflows","Build, edit, test, enable, and monitor PostHog workflows over MCP. Author the action\u002Fedge graph so it runs and opens cleanly in the visual editor, then change drafts surgically with patch operations. Use when asked to build, set up, automate, change, fix, or debug a workflow, campaign, broadcast, drip sequence, or event-triggered automation in the workflows product.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2208,2211,2214,2215],{"name":2209,"slug":2210,"type":15},"Automation","automation",{"name":2212,"slug":2213,"type":15},"MCP","mcp",{"name":9,"slug":8,"type":15},{"name":2216,"slug":2217,"type":15},"Workflow Automation","workflow-automation","2026-07-28T05:34:12.167015",{"slug":2220,"name":2220,"fn":2221,"description":2222,"org":2223,"tags":2224,"stars":26,"repoUrl":27,"updatedAt":2232},"check-posthog-loading","inspect PostHog SDK loading across URLs","Inspect how the PostHog JavaScript SDK is loaded across a list of URLs. Use to confirm consistent installation across pages, find pages missing the snippet, detect mismatched API keys or hosts between pages, and verify the load method (head snippet vs deferred vs array.js).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2225,2226,2227,2230,2231],{"name":24,"slug":25,"type":15},{"name":2189,"slug":2190,"type":15},{"name":2228,"slug":2229,"type":15},"Frontend","frontend",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-05-07T05:56:19.828048",{"slug":2234,"name":2234,"fn":2235,"description":2236,"org":2237,"tags":2238,"stars":26,"repoUrl":27,"updatedAt":2247},"consuming-endpoints-from-client-code","integrate PostHog endpoints into client applications","Wire a PostHog endpoint into a client app or SDK. Covers fetching the OpenAPI spec, generating a typed client with openapi-generator or @hey-api\u002Fopenapi-ts, sending the right auth header, shaping the variables payload (HogQL code_name vs insight breakdown property), handling rate-limit and materialised-endpoint error responses. Use when the user says \"how do I call my endpoint\", \"generate a client for this\", or \"what auth header do I use\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2239,2242,2243,2244],{"name":2240,"slug":2241,"type":15},"API Development","api-development",{"name":2228,"slug":2229,"type":15},{"name":9,"slug":8,"type":15},{"name":2245,"slug":2246,"type":15},"SDK","sdk","2026-06-08T08:08:34.929454",{"slug":2249,"name":2249,"fn":2250,"description":2251,"org":2252,"tags":2253,"stars":26,"repoUrl":27,"updatedAt":2257},"copying-endpoints-across-projects","copy PostHog endpoints across projects","Copy a PostHog endpoint (a saved HogQL\u002Finsight query exposed as an API route) to another project in the same organization, or duplicate it under a new name in the same project. Use when the user wants to duplicate an endpoint, promote an endpoint from staging to production, replicate an endpoint's query\u002Fvariables\u002Ffreshness config in another workspace, or clone an endpoint to iterate on it. Unlike feature flags and experiments, endpoints have NO native cross-project copy tool — this skill covers the read-then-recreate flow (endpoint-get then endpoint-create), the active-project switching it requires, name-collision checks, and the safe defaults (land unmaterialised in the target, verify with endpoint-run). Does not cover editing endpoint versions (see managing-endpoint-versions) or authoring a brand-new endpoint from scratch (see creating-an-endpoint).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2254,2255,2256],{"name":2240,"slug":2241,"type":15},{"name":17,"slug":18,"type":15},{"name":9,"slug":8,"type":15},"2026-07-15T05:29:58.442727",{"slug":2259,"name":2259,"fn":2260,"description":2261,"org":2262,"tags":2263,"stars":26,"repoUrl":27,"updatedAt":2275},"creating-ai-subscription","schedule recurring AI-generated PostHog reports","Create a recurring AI-generated PostHog report — schedule a free-text prompt to run on a cron, with the LLM-synthesized markdown delivered to email or Slack on each tick. Use when the user wants a recurring AI summary of X on any cadence (daily, weekly, monthly, yearly) rather than a one-off report. (To attach an AI summary to an existing insight\u002Fdashboard subscription instead of a free-text prompt, see `managing-subscriptions` and its `summary_enabled` option.)\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2264,2265,2268,2269,2272],{"name":2209,"slug":2210,"type":15},{"name":2266,"slug":2267,"type":15},"Email","email",{"name":9,"slug":8,"type":15},{"name":2270,"slug":2271,"type":15},"Reporting","reporting",{"name":2273,"slug":2274,"type":15},"Slack","slack","2026-06-09T07:32:27.935712",{"slug":2277,"name":2277,"fn":2278,"description":2279,"org":2280,"tags":2281,"stars":26,"repoUrl":27,"updatedAt":2285},"creating-an-endpoint","create PostHog API endpoints","Create a PostHog endpoint with the right shape on the first try — covers query kind choice, name conventions, what to expose as variables (HogQL code_name vs insight breakdown), data_freshness_seconds, and whether to materialise on day one. Use when the user says \"create an endpoint\", \"expose this query as an API\", \"turn this insight into an endpoint\", or asks for help structuring a new endpoint. Steers away from common mistakes: materialising a query with cohort breakdowns or compare mode, inline-only variables on a materialised endpoint, unbounded date ranges, ambiguous names.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2282,2283,2284],{"name":24,"slug":25,"type":15},{"name":2240,"slug":2241,"type":15},{"name":9,"slug":8,"type":15},"2026-06-08T08:08:29.624498",231,{"items":2288,"total":2338},[2289,2296,2302,2309,2316,2323,2331],{"slug":2130,"name":2130,"fn":2131,"description":2132,"org":2290,"tags":2291,"stars":26,"repoUrl":27,"updatedAt":2141},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2292,2293,2294,2295],{"name":24,"slug":25,"type":15},{"name":2137,"slug":2138,"type":15},{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},{"slug":2143,"name":2143,"fn":2144,"description":2145,"org":2297,"tags":2298,"stars":26,"repoUrl":27,"updatedAt":2153},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2299,2300,2301],{"name":24,"slug":25,"type":15},{"name":2150,"slug":2151,"type":15},{"name":9,"slug":8,"type":15},{"slug":2155,"name":2155,"fn":2156,"description":2157,"org":2303,"tags":2304,"stars":26,"repoUrl":27,"updatedAt":2165},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2305,2306,2307,2308],{"name":2150,"slug":2151,"type":15},{"name":2162,"slug":35,"type":15},{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},{"slug":2167,"name":2167,"fn":2168,"description":2169,"org":2310,"tags":2311,"stars":26,"repoUrl":27,"updatedAt":2178},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2312,2313,2314,2315],{"name":2150,"slug":2151,"type":15},{"name":2162,"slug":35,"type":15},{"name":2175,"slug":2176,"type":15},{"name":9,"slug":8,"type":15},{"slug":2180,"name":2180,"fn":2181,"description":2182,"org":2317,"tags":2318,"stars":26,"repoUrl":27,"updatedAt":2193},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2319,2320,2321,2322],{"name":2186,"slug":2187,"type":15},{"name":2189,"slug":2190,"type":15},{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},{"slug":4,"name":4,"fn":5,"description":6,"org":2324,"tags":2325,"stars":26,"repoUrl":27,"updatedAt":28},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2326,2327,2328,2329,2330],{"name":24,"slug":25,"type":15},{"name":21,"slug":22,"type":15},{"name":13,"slug":14,"type":15},{"name":17,"slug":18,"type":15},{"name":9,"slug":8,"type":15},{"slug":2203,"name":2203,"fn":2204,"description":2205,"org":2332,"tags":2333,"stars":26,"repoUrl":27,"updatedAt":2218},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2334,2335,2336,2337],{"name":2209,"slug":2210,"type":15},{"name":2212,"slug":2213,"type":15},{"name":9,"slug":8,"type":15},{"name":2216,"slug":2217,"type":15},61]