[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-posthog-exploring-endpoint-execution-logs":3,"mdc-phfngp-key":49,"related-org-posthog-exploring-endpoint-execution-logs":975,"related-repo-posthog-exploring-endpoint-execution-logs":1141},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":44,"sourceUrl":47,"mdContent":48},"exploring-endpoint-execution-logs","diagnose PostHog endpoint execution logs","Explore and diagnose a PostHog endpoint's execution logs — error messages, failed runs, cache misses, slow runs, or unexpected row counts during endpoint invocations. Use when the user says \"my endpoint is failing\", \"show me the logs for endpoint X\", \"what error did endpoint Y produce\", \"why did endpoint Z return no rows\", \"is this endpoint hitting cache\", or \"check the last N runs\". Focused on a single named endpoint's runtime log entries, not project-wide auditing or query performance profiling.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"posthog","PostHog","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fposthog.png",[12,16,19,20],{"name":13,"slug":14,"type":15},"Observability","observability","tag",{"name":17,"slug":18,"type":15},"Logs","logs",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"Debugging","debugging",35568,"https:\u002F\u002Fgithub.com\u002FPostHog\u002Fposthog","2026-06-11T08:13:56.538353",null,2977,[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"ab-testing","ai-analytics","analytics","cdp","data-warehouse","experiments","feature-flags","javascript","product-analytics","python","react","session-replay","surveys","typescript","web-analytics",{"repoUrl":24,"stars":23,"forks":27,"topics":45,"description":46},[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"🦔 PostHog is an all-in-one developer platform for building successful products. We offer product analytics, web analytics, session replay, error tracking, feature flags, experimentation, surveys, data warehouse, a CDP, and an AI product assistant to help debug your code, ship features faster, and keep all your usage and customer data in one stack.","https:\u002F\u002Fgithub.com\u002FPostHog\u002Fposthog\u002Ftree\u002FHEAD\u002Fproducts\u002Fendpoints\u002Fskills\u002Fexploring-endpoint-execution-logs","---\nname: exploring-endpoint-execution-logs\ndescription: >\n  Explore and diagnose a PostHog endpoint's execution logs — error messages, failed runs, cache\n  misses, slow runs, or unexpected row counts during endpoint invocations. Use when the user says\n  \"my endpoint is failing\", \"show me the logs for endpoint X\", \"what error did endpoint Y produce\",\n  \"why did endpoint Z return no rows\", \"is this endpoint hitting cache\", or \"check the last N runs\".\n  Focused on a single named endpoint's runtime log entries, not project-wide auditing or query\n  performance profiling.\n---\n\n# Exploring endpoint execution logs\n\nEvery endpoint run emits one execution log entry to PostHog's `log_entries` store. This skill\nreads those entries for a specific endpoint to answer \"what happened when it ran?\". It is the\nlog-level counterpart to `diagnosing-endpoint-performance` (which reasons about cache\u002Fmaterialisation\nstrategy from config and `query_log`).\n\n## When to use this skill\n\n- \"Why is my endpoint failing \u002F erroring?\"\n- \"Show me the logs \u002F recent runs for endpoint X\"\n- \"Did the last run hit cache? How many rows did it return?\"\n- \"What happened the last time endpoint Y ran?\"\n\nIf the question is \"this endpoint is slow, what should I change?\", use\n`diagnosing-endpoint-performance`. If it's project-wide (\"what can I clean up?\"), use\n`auditing-endpoints`.\n\n## What an execution log entry looks like\n\nEach run produces exactly one entry. The level is `INFO` on success and `ERROR` on failure, and the\nmessage carries the extra data as searchable `key=value` tokens:\n\n```text\nEndpoint executed · path=materialized cache=hit duration_ms=142 rows=1024 version=3\nEndpoint execution failed · path=inline error=ResolutionError version=3\n```\n\nToken meanings:\n\n| Token         | Values                                                       | Meaning                                                        |\n| ------------- | ------------------------------------------------------------ | -------------------------------------------------------------- |\n| `path`        | `materialized` \u002F `inline` \u002F `ducklake` \u002F `ducklake_fallback` | Which execution path ran                                       |\n| `cache`       | `hit` \u002F `miss`                                               | Whether the query result cache was used (omitted for ducklake) |\n| `duration_ms` | integer                                                      | Wall-clock execution time                                      |\n| `rows`        | integer                                                      | Number of result rows returned                                 |\n| `version`     | integer                                                      | Which endpoint version ran                                     |\n| `error`       | e.g. `ResolutionError`, `HogVMException`                     | Error class \u002F HogQL code name (failures only)                  |\n\nEach run gets a distinct `instance_id`, so logs group one-per-execution in the viewer.\n\n## Available tools\n\n| Tool            | Purpose                                                                                                                       |\n| --------------- | ----------------------------------------------------------------------------------------------------------------------------- |\n| `endpoint-logs` | Primary. Execution log entries for one endpoint by name. Filter by level, search, time range, instance_id; `limit` up to 500. |\n| `endpoint-get`  | Endpoint config for context (current version, materialisation, query kind)                                                    |\n| `execute-sql`   | Fallback \u002F aggregation directly against `log_entries` (`log_source='endpoints'`)                                              |\n\n## Filtering\n\n`endpoint-logs` exposes the standard log filters:\n\n- **level** — comma-separated, e.g. `ERROR` to see only failed runs, or `INFO,ERROR` for all.\n- **search** — case-insensitive substring over the message. Because the extra data is in\n  `key=value` tokens, you can search `cache=miss`, `path=inline`, `error=ResolutionError`, or a\n  specific `version=3`.\n- **after \u002F before** — ISO timestamps to bound the time range.\n- **instance_id** — pin a single execution.\n- **limit** — 1–500 (default 50).\n\n## Workflow\n\n1. Identify the endpoint by name. If given a URL, parse it from\n   `\u002Fapi\u002Fprojects\u002F{team_id}\u002Fendpoints\u002F{name}\u002Frun`.\n2. Start broad: `endpoint-logs` for the endpoint with a recent time range. Skim levels and tokens.\n3. Narrow to the symptom:\n   - Failures → `level=ERROR`; read the `error=` token and `path=` to see where it broke.\n   - Cache concerns → `search=cache=miss` to see how often runs miss cache.\n   - Wrong results → compare `rows=` across runs, and `version=` to spot a regression after a\n     version bump.\n4. For counts\u002Ftrends across many runs (e.g. error rate over a week), drop to `execute-sql` against\n   `log_entries`:\n\n   ```sql\n   SELECT toDate(timestamp) AS day, upper(level) AS level, count() AS runs\n   FROM log_entries\n   WHERE log_source = 'endpoints' AND log_source_id = '\u003Cendpoint_uuid>'\n   GROUP BY day, level ORDER BY day DESC\n   ```\n\n   Get the endpoint UUID from `endpoint-get` (the `log_source_id` is the endpoint id, not its name).\n\n5. Summarize: what's failing, since when, on which version\u002Fpath, and whether it's a config issue\n   (hand off to `diagnosing-endpoint-performance`) or a query bug.\n\n## Example interaction\n\n```text\nUser: \"weekly_signups started erroring this morning\"\n\nAgent steps:\n- endpoint-logs weekly_signups, level=ERROR, after=\u003Cthis morning>\n  → several \"Endpoint execution failed · path=inline error=ResolutionError version=5\"\n- endpoint-get weekly_signups → current version is v5 (bumped today)\n- endpoint-logs weekly_signups, level=INFO, before=\u003Cthis morning>\n  → prior runs: \"path=inline cache=hit ... version=4\" succeeded\n\n- \"v5 (created this morning) is failing with a ResolutionError on the inline path — it can't\n   resolve a table or field reference. v4 ran fine. This looks like a bad query in the new\n   version. Want me to pull the v5 query (endpoint-versions) so we can fix it, or roll back to v4?\"\n```\n\n## Important notes\n\n- **One entry per run.** Don't expect step-by-step traces — endpoints log a single completion line.\n  The detail lives in the tokens, not in multiple lines.\n- **`log_source_id` is the endpoint UUID**, not the name. For `execute-sql`, fetch it via\n  `endpoint-get` first.\n- **Logs are retained ~90 days** (the `log_entries` TTL). Older runs won't appear.\n- **Execution logs ≠ query performance.** `endpoint-logs` tells you what happened and why a run\n  failed; for \"should I materialise \u002F bump cache TTL?\" use `diagnosing-endpoint-performance`, which\n  reasons over config and `query_log` cost metrics.\n- **Best-effort emission.** A log line is emitted after each run but never blocks it — if a run\n  succeeded for the caller but no log shows, the emit was dropped, not the query.\n",{"data":50,"body":51},{"name":4,"description":6},{"type":52,"children":53},"root",[54,62,93,100,125,145,151,180,192,197,411,424,430,526,532,542,645,651,849,855,864,870,969],{"type":55,"tag":56,"props":57,"children":58},"element","h1",{"id":4},[59],{"type":60,"value":61},"text","Exploring endpoint execution logs",{"type":55,"tag":63,"props":64,"children":65},"p",{},[66,68,75,77,83,85,91],{"type":60,"value":67},"Every endpoint run emits one execution log entry to PostHog's ",{"type":55,"tag":69,"props":70,"children":72},"code",{"className":71},[],[73],{"type":60,"value":74},"log_entries",{"type":60,"value":76}," store. This skill\nreads those entries for a specific endpoint to answer \"what happened when it ran?\". It is the\nlog-level counterpart to ",{"type":55,"tag":69,"props":78,"children":80},{"className":79},[],[81],{"type":60,"value":82},"diagnosing-endpoint-performance",{"type":60,"value":84}," (which reasons about cache\u002Fmaterialisation\nstrategy from config and ",{"type":55,"tag":69,"props":86,"children":88},{"className":87},[],[89],{"type":60,"value":90},"query_log",{"type":60,"value":92},").",{"type":55,"tag":94,"props":95,"children":97},"h2",{"id":96},"when-to-use-this-skill",[98],{"type":60,"value":99},"When to use this skill",{"type":55,"tag":101,"props":102,"children":103},"ul",{},[104,110,115,120],{"type":55,"tag":105,"props":106,"children":107},"li",{},[108],{"type":60,"value":109},"\"Why is my endpoint failing \u002F erroring?\"",{"type":55,"tag":105,"props":111,"children":112},{},[113],{"type":60,"value":114},"\"Show me the logs \u002F recent runs for endpoint X\"",{"type":55,"tag":105,"props":116,"children":117},{},[118],{"type":60,"value":119},"\"Did the last run hit cache? How many rows did it return?\"",{"type":55,"tag":105,"props":121,"children":122},{},[123],{"type":60,"value":124},"\"What happened the last time endpoint Y ran?\"",{"type":55,"tag":63,"props":126,"children":127},{},[128,130,135,137,143],{"type":60,"value":129},"If the question is \"this endpoint is slow, what should I change?\", use\n",{"type":55,"tag":69,"props":131,"children":133},{"className":132},[],[134],{"type":60,"value":82},{"type":60,"value":136},". If it's project-wide (\"what can I clean up?\"), use\n",{"type":55,"tag":69,"props":138,"children":140},{"className":139},[],[141],{"type":60,"value":142},"auditing-endpoints",{"type":60,"value":144},".",{"type":55,"tag":94,"props":146,"children":148},{"id":147},"what-an-execution-log-entry-looks-like",[149],{"type":60,"value":150},"What an execution log entry looks like",{"type":55,"tag":63,"props":152,"children":153},{},[154,156,162,164,170,172,178],{"type":60,"value":155},"Each run produces exactly one entry. The level is ",{"type":55,"tag":69,"props":157,"children":159},{"className":158},[],[160],{"type":60,"value":161},"INFO",{"type":60,"value":163}," on success and ",{"type":55,"tag":69,"props":165,"children":167},{"className":166},[],[168],{"type":60,"value":169},"ERROR",{"type":60,"value":171}," on failure, and the\nmessage carries the extra data as searchable ",{"type":55,"tag":69,"props":173,"children":175},{"className":174},[],[176],{"type":60,"value":177},"key=value",{"type":60,"value":179}," tokens:",{"type":55,"tag":181,"props":182,"children":187},"pre",{"className":183,"code":185,"language":60,"meta":186},[184],"language-text","Endpoint executed · path=materialized cache=hit duration_ms=142 rows=1024 version=3\nEndpoint execution failed · path=inline error=ResolutionError version=3\n","",[188],{"type":55,"tag":69,"props":189,"children":190},{"__ignoreMap":186},[191],{"type":60,"value":185},{"type":55,"tag":63,"props":193,"children":194},{},[195],{"type":60,"value":196},"Token meanings:",{"type":55,"tag":198,"props":199,"children":200},"table",{},[201,225],{"type":55,"tag":202,"props":203,"children":204},"thead",{},[205],{"type":55,"tag":206,"props":207,"children":208},"tr",{},[209,215,220],{"type":55,"tag":210,"props":211,"children":212},"th",{},[213],{"type":60,"value":214},"Token",{"type":55,"tag":210,"props":216,"children":217},{},[218],{"type":60,"value":219},"Values",{"type":55,"tag":210,"props":221,"children":222},{},[223],{"type":60,"value":224},"Meaning",{"type":55,"tag":226,"props":227,"children":228},"tbody",{},[229,278,311,333,354,375],{"type":55,"tag":206,"props":230,"children":231},{},[232,242,273],{"type":55,"tag":233,"props":234,"children":235},"td",{},[236],{"type":55,"tag":69,"props":237,"children":239},{"className":238},[],[240],{"type":60,"value":241},"path",{"type":55,"tag":233,"props":243,"children":244},{},[245,251,253,259,260,266,267],{"type":55,"tag":69,"props":246,"children":248},{"className":247},[],[249],{"type":60,"value":250},"materialized",{"type":60,"value":252}," \u002F ",{"type":55,"tag":69,"props":254,"children":256},{"className":255},[],[257],{"type":60,"value":258},"inline",{"type":60,"value":252},{"type":55,"tag":69,"props":261,"children":263},{"className":262},[],[264],{"type":60,"value":265},"ducklake",{"type":60,"value":252},{"type":55,"tag":69,"props":268,"children":270},{"className":269},[],[271],{"type":60,"value":272},"ducklake_fallback",{"type":55,"tag":233,"props":274,"children":275},{},[276],{"type":60,"value":277},"Which execution path ran",{"type":55,"tag":206,"props":279,"children":280},{},[281,290,306],{"type":55,"tag":233,"props":282,"children":283},{},[284],{"type":55,"tag":69,"props":285,"children":287},{"className":286},[],[288],{"type":60,"value":289},"cache",{"type":55,"tag":233,"props":291,"children":292},{},[293,299,300],{"type":55,"tag":69,"props":294,"children":296},{"className":295},[],[297],{"type":60,"value":298},"hit",{"type":60,"value":252},{"type":55,"tag":69,"props":301,"children":303},{"className":302},[],[304],{"type":60,"value":305},"miss",{"type":55,"tag":233,"props":307,"children":308},{},[309],{"type":60,"value":310},"Whether the query result cache was used (omitted for ducklake)",{"type":55,"tag":206,"props":312,"children":313},{},[314,323,328],{"type":55,"tag":233,"props":315,"children":316},{},[317],{"type":55,"tag":69,"props":318,"children":320},{"className":319},[],[321],{"type":60,"value":322},"duration_ms",{"type":55,"tag":233,"props":324,"children":325},{},[326],{"type":60,"value":327},"integer",{"type":55,"tag":233,"props":329,"children":330},{},[331],{"type":60,"value":332},"Wall-clock execution time",{"type":55,"tag":206,"props":334,"children":335},{},[336,345,349],{"type":55,"tag":233,"props":337,"children":338},{},[339],{"type":55,"tag":69,"props":340,"children":342},{"className":341},[],[343],{"type":60,"value":344},"rows",{"type":55,"tag":233,"props":346,"children":347},{},[348],{"type":60,"value":327},{"type":55,"tag":233,"props":350,"children":351},{},[352],{"type":60,"value":353},"Number of result rows returned",{"type":55,"tag":206,"props":355,"children":356},{},[357,366,370],{"type":55,"tag":233,"props":358,"children":359},{},[360],{"type":55,"tag":69,"props":361,"children":363},{"className":362},[],[364],{"type":60,"value":365},"version",{"type":55,"tag":233,"props":367,"children":368},{},[369],{"type":60,"value":327},{"type":55,"tag":233,"props":371,"children":372},{},[373],{"type":60,"value":374},"Which endpoint version ran",{"type":55,"tag":206,"props":376,"children":377},{},[378,387,406],{"type":55,"tag":233,"props":379,"children":380},{},[381],{"type":55,"tag":69,"props":382,"children":384},{"className":383},[],[385],{"type":60,"value":386},"error",{"type":55,"tag":233,"props":388,"children":389},{},[390,392,398,400],{"type":60,"value":391},"e.g. ",{"type":55,"tag":69,"props":393,"children":395},{"className":394},[],[396],{"type":60,"value":397},"ResolutionError",{"type":60,"value":399},", ",{"type":55,"tag":69,"props":401,"children":403},{"className":402},[],[404],{"type":60,"value":405},"HogVMException",{"type":55,"tag":233,"props":407,"children":408},{},[409],{"type":60,"value":410},"Error class \u002F HogQL code name (failures only)",{"type":55,"tag":63,"props":412,"children":413},{},[414,416,422],{"type":60,"value":415},"Each run gets a distinct ",{"type":55,"tag":69,"props":417,"children":419},{"className":418},[],[420],{"type":60,"value":421},"instance_id",{"type":60,"value":423},", so logs group one-per-execution in the viewer.",{"type":55,"tag":94,"props":425,"children":427},{"id":426},"available-tools",[428],{"type":60,"value":429},"Available tools",{"type":55,"tag":198,"props":431,"children":432},{},[433,449],{"type":55,"tag":202,"props":434,"children":435},{},[436],{"type":55,"tag":206,"props":437,"children":438},{},[439,444],{"type":55,"tag":210,"props":440,"children":441},{},[442],{"type":60,"value":443},"Tool",{"type":55,"tag":210,"props":445,"children":446},{},[447],{"type":60,"value":448},"Purpose",{"type":55,"tag":226,"props":450,"children":451},{},[452,477,494],{"type":55,"tag":206,"props":453,"children":454},{},[455,464],{"type":55,"tag":233,"props":456,"children":457},{},[458],{"type":55,"tag":69,"props":459,"children":461},{"className":460},[],[462],{"type":60,"value":463},"endpoint-logs",{"type":55,"tag":233,"props":465,"children":466},{},[467,469,475],{"type":60,"value":468},"Primary. Execution log entries for one endpoint by name. Filter by level, search, time range, instance_id; ",{"type":55,"tag":69,"props":470,"children":472},{"className":471},[],[473],{"type":60,"value":474},"limit",{"type":60,"value":476}," up to 500.",{"type":55,"tag":206,"props":478,"children":479},{},[480,489],{"type":55,"tag":233,"props":481,"children":482},{},[483],{"type":55,"tag":69,"props":484,"children":486},{"className":485},[],[487],{"type":60,"value":488},"endpoint-get",{"type":55,"tag":233,"props":490,"children":491},{},[492],{"type":60,"value":493},"Endpoint config for context (current version, materialisation, query kind)",{"type":55,"tag":206,"props":495,"children":496},{},[497,506],{"type":55,"tag":233,"props":498,"children":499},{},[500],{"type":55,"tag":69,"props":501,"children":503},{"className":502},[],[504],{"type":60,"value":505},"execute-sql",{"type":55,"tag":233,"props":507,"children":508},{},[509,511,516,518,524],{"type":60,"value":510},"Fallback \u002F aggregation directly against ",{"type":55,"tag":69,"props":512,"children":514},{"className":513},[],[515],{"type":60,"value":74},{"type":60,"value":517}," (",{"type":55,"tag":69,"props":519,"children":521},{"className":520},[],[522],{"type":60,"value":523},"log_source='endpoints'",{"type":60,"value":525},")",{"type":55,"tag":94,"props":527,"children":529},{"id":528},"filtering",[530],{"type":60,"value":531},"Filtering",{"type":55,"tag":63,"props":533,"children":534},{},[535,540],{"type":55,"tag":69,"props":536,"children":538},{"className":537},[],[539],{"type":60,"value":463},{"type":60,"value":541}," exposes the standard log filters:",{"type":55,"tag":101,"props":543,"children":544},{},[545,571,617,627,636],{"type":55,"tag":105,"props":546,"children":547},{},[548,554,556,561,563,569],{"type":55,"tag":549,"props":550,"children":551},"strong",{},[552],{"type":60,"value":553},"level",{"type":60,"value":555}," — comma-separated, e.g. ",{"type":55,"tag":69,"props":557,"children":559},{"className":558},[],[560],{"type":60,"value":169},{"type":60,"value":562}," to see only failed runs, or ",{"type":55,"tag":69,"props":564,"children":566},{"className":565},[],[567],{"type":60,"value":568},"INFO,ERROR",{"type":60,"value":570}," for all.",{"type":55,"tag":105,"props":572,"children":573},{},[574,579,581,586,588,594,595,601,602,608,610,616],{"type":55,"tag":549,"props":575,"children":576},{},[577],{"type":60,"value":578},"search",{"type":60,"value":580}," — case-insensitive substring over the message. Because the extra data is in\n",{"type":55,"tag":69,"props":582,"children":584},{"className":583},[],[585],{"type":60,"value":177},{"type":60,"value":587}," tokens, you can search ",{"type":55,"tag":69,"props":589,"children":591},{"className":590},[],[592],{"type":60,"value":593},"cache=miss",{"type":60,"value":399},{"type":55,"tag":69,"props":596,"children":598},{"className":597},[],[599],{"type":60,"value":600},"path=inline",{"type":60,"value":399},{"type":55,"tag":69,"props":603,"children":605},{"className":604},[],[606],{"type":60,"value":607},"error=ResolutionError",{"type":60,"value":609},", or a\nspecific ",{"type":55,"tag":69,"props":611,"children":613},{"className":612},[],[614],{"type":60,"value":615},"version=3",{"type":60,"value":144},{"type":55,"tag":105,"props":618,"children":619},{},[620,625],{"type":55,"tag":549,"props":621,"children":622},{},[623],{"type":60,"value":624},"after \u002F before",{"type":60,"value":626}," — ISO timestamps to bound the time range.",{"type":55,"tag":105,"props":628,"children":629},{},[630,634],{"type":55,"tag":549,"props":631,"children":632},{},[633],{"type":60,"value":421},{"type":60,"value":635}," — pin a single execution.",{"type":55,"tag":105,"props":637,"children":638},{},[639,643],{"type":55,"tag":549,"props":640,"children":641},{},[642],{"type":60,"value":474},{"type":60,"value":644}," — 1–500 (default 50).",{"type":55,"tag":94,"props":646,"children":648},{"id":647},"workflow",[649],{"type":60,"value":650},"Workflow",{"type":55,"tag":652,"props":653,"children":654},"ol",{},[655,667,679,750,837],{"type":55,"tag":105,"props":656,"children":657},{},[658,660,666],{"type":60,"value":659},"Identify the endpoint by name. If given a URL, parse it from\n",{"type":55,"tag":69,"props":661,"children":663},{"className":662},[],[664],{"type":60,"value":665},"\u002Fapi\u002Fprojects\u002F{team_id}\u002Fendpoints\u002F{name}\u002Frun",{"type":60,"value":144},{"type":55,"tag":105,"props":668,"children":669},{},[670,672,677],{"type":60,"value":671},"Start broad: ",{"type":55,"tag":69,"props":673,"children":675},{"className":674},[],[676],{"type":60,"value":463},{"type":60,"value":678}," for the endpoint with a recent time range. Skim levels and tokens.",{"type":55,"tag":105,"props":680,"children":681},{},[682,684],{"type":60,"value":683},"Narrow to the symptom:",{"type":55,"tag":101,"props":685,"children":686},{},[687,716,729],{"type":55,"tag":105,"props":688,"children":689},{},[690,692,698,700,706,708,714],{"type":60,"value":691},"Failures → ",{"type":55,"tag":69,"props":693,"children":695},{"className":694},[],[696],{"type":60,"value":697},"level=ERROR",{"type":60,"value":699},"; read the ",{"type":55,"tag":69,"props":701,"children":703},{"className":702},[],[704],{"type":60,"value":705},"error=",{"type":60,"value":707}," token and ",{"type":55,"tag":69,"props":709,"children":711},{"className":710},[],[712],{"type":60,"value":713},"path=",{"type":60,"value":715}," to see where it broke.",{"type":55,"tag":105,"props":717,"children":718},{},[719,721,727],{"type":60,"value":720},"Cache concerns → ",{"type":55,"tag":69,"props":722,"children":724},{"className":723},[],[725],{"type":60,"value":726},"search=cache=miss",{"type":60,"value":728}," to see how often runs miss cache.",{"type":55,"tag":105,"props":730,"children":731},{},[732,734,740,742,748],{"type":60,"value":733},"Wrong results → compare ",{"type":55,"tag":69,"props":735,"children":737},{"className":736},[],[738],{"type":60,"value":739},"rows=",{"type":60,"value":741}," across runs, and ",{"type":55,"tag":69,"props":743,"children":745},{"className":744},[],[746],{"type":60,"value":747},"version=",{"type":60,"value":749}," to spot a regression after a\nversion bump.",{"type":55,"tag":105,"props":751,"children":752},{},[753,755,760,762,767,769,816,820,822,827,829,835],{"type":60,"value":754},"For counts\u002Ftrends across many runs (e.g. error rate over a week), drop to ",{"type":55,"tag":69,"props":756,"children":758},{"className":757},[],[759],{"type":60,"value":505},{"type":60,"value":761}," against\n",{"type":55,"tag":69,"props":763,"children":765},{"className":764},[],[766],{"type":60,"value":74},{"type":60,"value":768},":",{"type":55,"tag":181,"props":770,"children":774},{"className":771,"code":772,"language":773,"meta":186,"style":186},"language-sql shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","SELECT toDate(timestamp) AS day, upper(level) AS level, count() AS runs\nFROM log_entries\nWHERE log_source = 'endpoints' AND log_source_id = '\u003Cendpoint_uuid>'\nGROUP BY day, level ORDER BY day DESC\n","sql",[775],{"type":55,"tag":69,"props":776,"children":777},{"__ignoreMap":186},[778,789,798,807],{"type":55,"tag":779,"props":780,"children":783},"span",{"class":781,"line":782},"line",1,[784],{"type":55,"tag":779,"props":785,"children":786},{},[787],{"type":60,"value":788},"SELECT toDate(timestamp) AS day, upper(level) AS level, count() AS runs\n",{"type":55,"tag":779,"props":790,"children":792},{"class":781,"line":791},2,[793],{"type":55,"tag":779,"props":794,"children":795},{},[796],{"type":60,"value":797},"FROM log_entries\n",{"type":55,"tag":779,"props":799,"children":801},{"class":781,"line":800},3,[802],{"type":55,"tag":779,"props":803,"children":804},{},[805],{"type":60,"value":806},"WHERE log_source = 'endpoints' AND log_source_id = '\u003Cendpoint_uuid>'\n",{"type":55,"tag":779,"props":808,"children":810},{"class":781,"line":809},4,[811],{"type":55,"tag":779,"props":812,"children":813},{},[814],{"type":60,"value":815},"GROUP BY day, level ORDER BY day DESC\n",{"type":55,"tag":817,"props":818,"children":819},"br",{},[],{"type":60,"value":821},"Get the endpoint UUID from ",{"type":55,"tag":69,"props":823,"children":825},{"className":824},[],[826],{"type":60,"value":488},{"type":60,"value":828}," (the ",{"type":55,"tag":69,"props":830,"children":832},{"className":831},[],[833],{"type":60,"value":834},"log_source_id",{"type":60,"value":836}," is the endpoint id, not its name).",{"type":55,"tag":105,"props":838,"children":839},{},[840,842,847],{"type":60,"value":841},"Summarize: what's failing, since when, on which version\u002Fpath, and whether it's a config issue\n(hand off to ",{"type":55,"tag":69,"props":843,"children":845},{"className":844},[],[846],{"type":60,"value":82},{"type":60,"value":848},") or a query bug.",{"type":55,"tag":94,"props":850,"children":852},{"id":851},"example-interaction",[853],{"type":60,"value":854},"Example interaction",{"type":55,"tag":181,"props":856,"children":859},{"className":857,"code":858,"language":60,"meta":186},[184],"User: \"weekly_signups started erroring this morning\"\n\nAgent steps:\n- endpoint-logs weekly_signups, level=ERROR, after=\u003Cthis morning>\n  → several \"Endpoint execution failed · path=inline error=ResolutionError version=5\"\n- endpoint-get weekly_signups → current version is v5 (bumped today)\n- endpoint-logs weekly_signups, level=INFO, before=\u003Cthis morning>\n  → prior runs: \"path=inline cache=hit ... version=4\" succeeded\n\n- \"v5 (created this morning) is failing with a ResolutionError on the inline path — it can't\n   resolve a table or field reference. v4 ran fine. This looks like a bad query in the new\n   version. Want me to pull the v5 query (endpoint-versions) so we can fix it, or roll back to v4?\"\n",[860],{"type":55,"tag":69,"props":861,"children":862},{"__ignoreMap":186},[863],{"type":60,"value":858},{"type":55,"tag":94,"props":865,"children":867},{"id":866},"important-notes",[868],{"type":60,"value":869},"Important notes",{"type":55,"tag":101,"props":871,"children":872},{},[873,883,912,928,959],{"type":55,"tag":105,"props":874,"children":875},{},[876,881],{"type":55,"tag":549,"props":877,"children":878},{},[879],{"type":60,"value":880},"One entry per run.",{"type":60,"value":882}," Don't expect step-by-step traces — endpoints log a single completion line.\nThe detail lives in the tokens, not in multiple lines.",{"type":55,"tag":105,"props":884,"children":885},{},[886,896,898,903,905,910],{"type":55,"tag":549,"props":887,"children":888},{},[889,894],{"type":55,"tag":69,"props":890,"children":892},{"className":891},[],[893],{"type":60,"value":834},{"type":60,"value":895}," is the endpoint UUID",{"type":60,"value":897},", not the name. For ",{"type":55,"tag":69,"props":899,"children":901},{"className":900},[],[902],{"type":60,"value":505},{"type":60,"value":904},", fetch it via\n",{"type":55,"tag":69,"props":906,"children":908},{"className":907},[],[909],{"type":60,"value":488},{"type":60,"value":911}," first.",{"type":55,"tag":105,"props":913,"children":914},{},[915,920,921,926],{"type":55,"tag":549,"props":916,"children":917},{},[918],{"type":60,"value":919},"Logs are retained ~90 days",{"type":60,"value":828},{"type":55,"tag":69,"props":922,"children":924},{"className":923},[],[925],{"type":60,"value":74},{"type":60,"value":927}," TTL). Older runs won't appear.",{"type":55,"tag":105,"props":929,"children":930},{},[931,936,938,943,945,950,952,957],{"type":55,"tag":549,"props":932,"children":933},{},[934],{"type":60,"value":935},"Execution logs ≠ query performance.",{"type":60,"value":937}," ",{"type":55,"tag":69,"props":939,"children":941},{"className":940},[],[942],{"type":60,"value":463},{"type":60,"value":944}," tells you what happened and why a run\nfailed; for \"should I materialise \u002F bump cache TTL?\" use ",{"type":55,"tag":69,"props":946,"children":948},{"className":947},[],[949],{"type":60,"value":82},{"type":60,"value":951},", which\nreasons over config and ",{"type":55,"tag":69,"props":953,"children":955},{"className":954},[],[956],{"type":60,"value":90},{"type":60,"value":958}," cost metrics.",{"type":55,"tag":105,"props":960,"children":961},{},[962,967],{"type":55,"tag":549,"props":963,"children":964},{},[965],{"type":60,"value":966},"Best-effort emission.",{"type":60,"value":968}," A log line is emitted after each run but never blocks it — if a run\nsucceeded for the caller but no log shows, the emit was dropped, not the query.",{"type":55,"tag":970,"props":971,"children":972},"style",{},[973],{"type":60,"value":974},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":976,"total":1140},[977,991,1002,1014,1027,1040,1056,1073,1087,1102,1112,1130],{"slug":978,"name":978,"fn":979,"description":980,"org":981,"tags":982,"stars":23,"repoUrl":24,"updatedAt":990},"analyzing-expensive-users","analyze expensive users in AI observability","Analyze the most expensive users in AI observability and explain why they cost so much. Use when the user asks about top spenders, expensive users, per-user LLM cost, user-level cost drivers, or patterns behind high AI observability spend.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[983,985,988,989],{"name":984,"slug":31,"type":15},"Analytics",{"name":986,"slug":987,"type":15},"Cost Optimization","cost-optimization",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-07-28T05:34:11.117757",{"slug":142,"name":142,"fn":992,"description":993,"org":994,"tags":995,"stars":23,"repoUrl":24,"updatedAt":1001},"audit PostHog project endpoints","Audit every endpoint in a PostHog project for staleness, failed materialisations, and unused materialised versions. Use when the user asks \"what endpoints can I clean up?\", \"are any of my endpoints broken?\", \"which materialised versions are still being called?\", or wants a one-shot cleanup pass over the Endpoints product. Produces a prioritised report grouped by issue type, with recommended actions but does not modify anything without explicit confirmation.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[996,997,1000],{"name":984,"slug":31,"type":15},{"name":998,"slug":999,"type":15},"Audit","audit",{"name":9,"slug":8,"type":15},"2026-06-08T08:08:33.693989",{"slug":1003,"name":1003,"fn":1004,"description":1005,"org":1006,"tags":1007,"stars":23,"repoUrl":24,"updatedAt":1013},"auditing-warehouse-source-health","audit PostHog data warehouse source health","Audit the health of a PostHog project's data warehouse sources and syncs — find every broken or degraded source connection, sync schema, and webhook channel. Use when the user asks \"why are my imports failing?\", \"what's broken with my sources?\", \"why is my warehouse data stale?\", or wants a one-shot triage of source\u002Fsync health before deciding where to dig in. Produces a prioritized report grouped by severity, with recommended next steps. For materialized-view health use `auditing-warehouse-view-health`; for a single failing sync use `diagnosing-failed-warehouse-syncs`.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1008,1009,1011,1012],{"name":998,"slug":999,"type":15},{"name":1010,"slug":33,"type":15},"Data Warehouse",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-06-18T08:22:57.67984",{"slug":1015,"name":1015,"fn":1016,"description":1017,"org":1018,"tags":1019,"stars":23,"repoUrl":24,"updatedAt":1026},"auditing-warehouse-view-health","audit PostHog materialized view health","Audit the health of a PostHog project's materialized views (saved queries) — find every failed materialization and flag unused or stale materialized views that cost storage and compute. Use when the user asks \"which of my views are broken?\", \"why is this materialized view failing?\", \"are any of my views wasting compute?\", or wants a one-shot triage of view health. For source\u002Fsync health use `auditing-warehouse-source-health`.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1020,1021,1022,1025],{"name":998,"slug":999,"type":15},{"name":1010,"slug":33,"type":15},{"name":1023,"slug":1024,"type":15},"Performance","performance",{"name":9,"slug":8,"type":15},"2026-06-18T08:25:10.936787",{"slug":1028,"name":1028,"fn":1029,"description":1030,"org":1031,"tags":1032,"stars":23,"repoUrl":24,"updatedAt":1039},"authoring-error-tracking-alerts","author PostHog error tracking alerts","Author error tracking alerts that fire when an issue is created, reopened, or starts spiking. Use when the user asks to set up error notifications, route exceptions to Slack\u002Fwebhook\u002FLinear, or evaluate which error events are worth alerting on. Covers trigger-event selection, integration choice, dedup against existing alerts, and shipping with the canonical message body shape.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1033,1036,1037,1038],{"name":1034,"slug":1035,"type":15},"Alerting","alerting",{"name":21,"slug":22,"type":15},{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-06-18T08:24:40.318583",{"slug":1041,"name":1041,"fn":1042,"description":1043,"org":1044,"tags":1045,"stars":23,"repoUrl":24,"updatedAt":1055},"authoring-log-alerts","author log alerts in PostHog","Author useful, low-noise log alerts on services in a PostHog project. Use when the user asks to set up alerts for their logs, suggest alerts they should add, or evaluate whether a service is worth monitoring. Covers service triage, baseline characterisation, threshold drafting, back-testing via simulate, and shipping with a notification destination.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1046,1047,1050,1051,1054],{"name":984,"slug":31,"type":15},{"name":1048,"slug":1049,"type":15},"Monitoring","monitoring",{"name":13,"slug":14,"type":15},{"name":1052,"slug":1053,"type":15},"Operations","operations",{"name":9,"slug":8,"type":15},"2026-07-18T05:10:54.430898",{"slug":1057,"name":1057,"fn":1058,"description":1059,"org":1060,"tags":1061,"stars":23,"repoUrl":24,"updatedAt":1072},"building-workflows","build and edit PostHog workflows","Build, edit, test, enable, and monitor PostHog workflows over MCP. Author the action\u002Fedge graph so it runs and opens cleanly in the visual editor, then change drafts surgically with patch operations. Use when asked to build, set up, automate, change, fix, or debug a workflow, campaign, broadcast, drip sequence, or event-triggered automation in the workflows product.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1062,1065,1068,1069],{"name":1063,"slug":1064,"type":15},"Automation","automation",{"name":1066,"slug":1067,"type":15},"MCP","mcp",{"name":9,"slug":8,"type":15},{"name":1070,"slug":1071,"type":15},"Workflow Automation","workflow-automation","2026-07-28T05:34:12.167015",{"slug":1074,"name":1074,"fn":1075,"description":1076,"org":1077,"tags":1078,"stars":23,"repoUrl":24,"updatedAt":1086},"check-posthog-loading","inspect PostHog SDK loading across URLs","Inspect how the PostHog JavaScript SDK is loaded across a list of URLs. Use to confirm consistent installation across pages, find pages missing the snippet, detect mismatched API keys or hosts between pages, and verify the load method (head snippet vs deferred vs array.js).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1079,1080,1081,1084,1085],{"name":984,"slug":31,"type":15},{"name":21,"slug":22,"type":15},{"name":1082,"slug":1083,"type":15},"Frontend","frontend",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-05-07T05:56:19.828048",{"slug":1088,"name":1088,"fn":1089,"description":1090,"org":1091,"tags":1092,"stars":23,"repoUrl":24,"updatedAt":1101},"consuming-endpoints-from-client-code","integrate PostHog endpoints into client applications","Wire a PostHog endpoint into a client app or SDK. Covers fetching the OpenAPI spec, generating a typed client with openapi-generator or @hey-api\u002Fopenapi-ts, sending the right auth header, shaping the variables payload (HogQL code_name vs insight breakdown property), handling rate-limit and materialised-endpoint error responses. Use when the user says \"how do I call my endpoint\", \"generate a client for this\", or \"what auth header do I use\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1093,1096,1097,1098],{"name":1094,"slug":1095,"type":15},"API Development","api-development",{"name":1082,"slug":1083,"type":15},{"name":9,"slug":8,"type":15},{"name":1099,"slug":1100,"type":15},"SDK","sdk","2026-06-08T08:08:34.929454",{"slug":1103,"name":1103,"fn":1104,"description":1105,"org":1106,"tags":1107,"stars":23,"repoUrl":24,"updatedAt":1111},"copying-endpoints-across-projects","copy PostHog endpoints across projects","Copy a PostHog endpoint (a saved HogQL\u002Finsight query exposed as an API route) to another project in the same organization, or duplicate it under a new name in the same project. Use when the user wants to duplicate an endpoint, promote an endpoint from staging to production, replicate an endpoint's query\u002Fvariables\u002Ffreshness config in another workspace, or clone an endpoint to iterate on it. Unlike feature flags and experiments, endpoints have NO native cross-project copy tool — this skill covers the read-then-recreate flow (endpoint-get then endpoint-create), the active-project switching it requires, name-collision checks, and the safe defaults (land unmaterialised in the target, verify with endpoint-run). Does not cover editing endpoint versions (see managing-endpoint-versions) or authoring a brand-new endpoint from scratch (see creating-an-endpoint).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1108,1109,1110],{"name":1094,"slug":1095,"type":15},{"name":1052,"slug":1053,"type":15},{"name":9,"slug":8,"type":15},"2026-07-15T05:29:58.442727",{"slug":1113,"name":1113,"fn":1114,"description":1115,"org":1116,"tags":1117,"stars":23,"repoUrl":24,"updatedAt":1129},"creating-ai-subscription","schedule recurring AI-generated PostHog reports","Create a recurring AI-generated PostHog report — schedule a free-text prompt to run on a cron, with the LLM-synthesized markdown delivered to email or Slack on each tick. Use when the user wants a recurring AI summary of X on any cadence (daily, weekly, monthly, yearly) rather than a one-off report. (To attach an AI summary to an existing insight\u002Fdashboard subscription instead of a free-text prompt, see `managing-subscriptions` and its `summary_enabled` option.)\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1118,1119,1122,1123,1126],{"name":1063,"slug":1064,"type":15},{"name":1120,"slug":1121,"type":15},"Email","email",{"name":9,"slug":8,"type":15},{"name":1124,"slug":1125,"type":15},"Reporting","reporting",{"name":1127,"slug":1128,"type":15},"Slack","slack","2026-06-09T07:32:27.935712",{"slug":1131,"name":1131,"fn":1132,"description":1133,"org":1134,"tags":1135,"stars":23,"repoUrl":24,"updatedAt":1139},"creating-an-endpoint","create PostHog API endpoints","Create a PostHog endpoint with the right shape on the first try — covers query kind choice, name conventions, what to expose as variables (HogQL code_name vs insight breakdown), data_freshness_seconds, and whether to materialise on day one. Use when the user says \"create an endpoint\", \"expose this query as an API\", \"turn this insight into an endpoint\", or asks for help structuring a new endpoint. Steers away from common mistakes: materialising a query with cohort breakdowns or compare mode, inline-only variables on a materialised endpoint, unbounded date ranges, ambiguous names.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1136,1137,1138],{"name":984,"slug":31,"type":15},{"name":1094,"slug":1095,"type":15},{"name":9,"slug":8,"type":15},"2026-06-08T08:08:29.624498",231,{"items":1142,"total":1192},[1143,1150,1156,1163,1170,1177,1185],{"slug":978,"name":978,"fn":979,"description":980,"org":1144,"tags":1145,"stars":23,"repoUrl":24,"updatedAt":990},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1146,1147,1148,1149],{"name":984,"slug":31,"type":15},{"name":986,"slug":987,"type":15},{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},{"slug":142,"name":142,"fn":992,"description":993,"org":1151,"tags":1152,"stars":23,"repoUrl":24,"updatedAt":1001},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1153,1154,1155],{"name":984,"slug":31,"type":15},{"name":998,"slug":999,"type":15},{"name":9,"slug":8,"type":15},{"slug":1003,"name":1003,"fn":1004,"description":1005,"org":1157,"tags":1158,"stars":23,"repoUrl":24,"updatedAt":1013},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1159,1160,1161,1162],{"name":998,"slug":999,"type":15},{"name":1010,"slug":33,"type":15},{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},{"slug":1015,"name":1015,"fn":1016,"description":1017,"org":1164,"tags":1165,"stars":23,"repoUrl":24,"updatedAt":1026},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1166,1167,1168,1169],{"name":998,"slug":999,"type":15},{"name":1010,"slug":33,"type":15},{"name":1023,"slug":1024,"type":15},{"name":9,"slug":8,"type":15},{"slug":1028,"name":1028,"fn":1029,"description":1030,"org":1171,"tags":1172,"stars":23,"repoUrl":24,"updatedAt":1039},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1173,1174,1175,1176],{"name":1034,"slug":1035,"type":15},{"name":21,"slug":22,"type":15},{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},{"slug":1041,"name":1041,"fn":1042,"description":1043,"org":1178,"tags":1179,"stars":23,"repoUrl":24,"updatedAt":1055},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1180,1181,1182,1183,1184],{"name":984,"slug":31,"type":15},{"name":1048,"slug":1049,"type":15},{"name":13,"slug":14,"type":15},{"name":1052,"slug":1053,"type":15},{"name":9,"slug":8,"type":15},{"slug":1057,"name":1057,"fn":1058,"description":1059,"org":1186,"tags":1187,"stars":23,"repoUrl":24,"updatedAt":1072},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1188,1189,1190,1191],{"name":1063,"slug":1064,"type":15},{"name":1066,"slug":1067,"type":15},{"name":9,"slug":8,"type":15},{"name":1070,"slug":1071,"type":15},61]