[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-posthog-investigating-metric-anomalies":3,"mdc-pwbg55-key":52,"related-org-posthog-investigating-metric-anomalies":732,"related-repo-posthog-investigating-metric-anomalies":897},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":47,"sourceUrl":50,"mdContent":51},"investigating-metric-anomalies","investigate infrastructure metric anomalies","Investigates server\u002Finfrastructure metric anomalies in PostHog Metrics — from \"this metric is rising\u002Fdropping\u002Fspiking\" or a fired alert to a probable cause with evidence. Use when asked why a metric looks wrong (ingestion lag rising, error rate spiking, latency degrading, queue depth growing, throughput dropping), when an alert fires on an OTel\u002FPrometheus metric, or for any incident triage that starts from a metric symptom. Composes characterize-metric-anomaly, query-metrics, and metric-names-list with logs (query-logs) and traces (APM span tools) for cross-signal root-cause correlation.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"posthog","PostHog","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fposthog.png",[12,16,19,20,23],{"name":13,"slug":14,"type":15},"Observability","observability","tag",{"name":17,"slug":18,"type":15},"Alerting","alerting",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"Metrics","metrics",{"name":24,"slug":25,"type":15},"Debugging","debugging",35568,"https:\u002F\u002Fgithub.com\u002FPostHog\u002Fposthog","2026-06-17T08:35:56.092165",null,2977,[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"ab-testing","ai-analytics","analytics","cdp","data-warehouse","experiments","feature-flags","javascript","product-analytics","python","react","session-replay","surveys","typescript","web-analytics",{"repoUrl":27,"stars":26,"forks":30,"topics":48,"description":49},[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"🦔 PostHog is an all-in-one developer platform for building successful products. We offer product analytics, web analytics, session replay, error tracking, feature flags, experimentation, surveys, data warehouse, a CDP, and an AI product assistant to help debug your code, ship features faster, and keep all your usage and customer data in one stack.","https:\u002F\u002Fgithub.com\u002FPostHog\u002Fposthog\u002Ftree\u002FHEAD\u002Fproducts\u002Fmetrics\u002Fskills\u002Finvestigating-metric-anomalies","---\nname: investigating-metric-anomalies\ndescription: Investigates server\u002Finfrastructure metric anomalies in PostHog Metrics — from \"this metric is rising\u002Fdropping\u002Fspiking\" or a fired alert to a probable cause with evidence. Use when asked why a metric looks wrong (ingestion lag rising, error rate spiking, latency degrading, queue depth growing, throughput dropping), when an alert fires on an OTel\u002FPrometheus metric, or for any incident triage that starts from a metric symptom. Composes characterize-metric-anomaly, query-metrics, and metric-names-list with logs (query-logs) and traces (APM span tools) for cross-signal root-cause correlation.\n---\n\n# Investigating metric anomalies\n\nThe job: go from a metric symptom (\"ingestion lag is rising\") to a probable cause with evidence, fast. The metric tells you _what_ and _when_; logs and traces tell you _why_. Follow the loop below — it front-loads the cheap, high-information calls and only fans out when the blast radius is unclear.\n\n## The loop\n\n### 1. Pin down the metric\n\nIf you have the exact metric name, skip ahead. Otherwise call `metric-names-list` with a substring from the symptom (`lag`, `error`, `latency`, `queue`). The returned `metric_type` decides the lens: counters (`sum`) are only meaningful as `rate`\u002F`increase`, gauges as `avg`, histograms as `histogram_quantile`.\n\n### 2. Characterize first — one call, three answers\n\nCall `characterize-metric-anomaly` with the metric name and `anomalyFrom` (the alert fire time, or when the user says it started looking wrong; subtract some margin if unsure). It compares against the preceding window by default and answers:\n\n- **How bad:** `direction`, `change_ratio`, `anomaly_peak` vs `baseline_mean`. If `direction` is `flat`, your window or metric is wrong — widen the window, or compare against the same window yesterday via `baselineFrom`\u002F`baselineTo` (daily-pattern metrics often look \"anomalous\" against the immediately-preceding hours).\n- **When:** `onset_time` — treat this timestamp as the pivot for everything that follows.\n- **Where:** `top_movers` — label values whose behavior changed. One mover (a single pod, shard, or endpoint) means a localized culprit; everything moving together means a shared cause (an upstream dependency, a deploy, infra).\n\n### 3. Sharpen with targeted metric queries\n\nUse `query-metrics` to test the hypotheses the report raises:\n\n- Drill a mover: re-query with `filters` pinning the suspicious label value, grouped by a second key, to localize further (pod → container, endpoint → status code).\n- Normalize: a rising error count means nothing if traffic doubled — use `clauses` + `formula` (`errors \u002F requests`) to separate rate changes from volume changes.\n- Check the neighbors: query the obvious companion metrics over the same window (for lag: throughput and error counters of the same service; for latency: request rate and saturation gauges). Use the same `interval` so the grids align visually.\n\n### 4. Correlate across signals at the onset\n\nPivot into logs and traces using the **same service and a window bracketing `onset_time`** (a few buckets before, through the peak):\n\n- **Logs:** use `query-logs` (follow its own discover-first workflow) filtered to the implicated `service.name` and window, severity `error` first, then `warn`. Restarts, crash loops, connection errors, and deploy markers right before onset are the classic causes. Widen to other services in the request path if the service's own logs are clean.\n- **Traces:** use the APM span tools (`query-apm-spans` etc.) for the same service\u002Fwindow — slow or erroring spans show _which dependency_ degraded, and a `trace_id` from an exemplar or log line links a concrete request across all three signals.\n\n### 5. Conclude with evidence, not vibes\n\nState: the symptom (metric, magnitude, onset), the probable cause (what you found in logs\u002Ftraces and how its timing aligns with the onset), the blast radius (which services\u002Flabels are affected, from the movers and grouped queries), and the confidence level. If the cause is still ambiguous, say which hypothesis the evidence favors and what would disambiguate (e.g. \"the lag began draining at 20:12 — consistent with a consumer restart; check who restarted it\").\n\n## Worked example: \"ingestion lag is rising — why?\"\n\n1. `metric-names-list` with `value: \"lag\"` → `logs_rate_limiter_message_lag_seconds` (histogram) and friends.\n2. `characterize-metric-anomaly` on it with `anomalyFrom` = alert time → direction `up`, change ratio 40x, `onset_time` 20:10, top mover `service_name = logs-ingestion` (the other services' lag stayed flat) — so the logs consumer specifically is behind, not the whole pipeline.\n3. `query-metrics`: `rate` of the consumer's throughput counter over the same window → throughput was **zero** during the gap and spiked after onset: the consumer wasn't slow, it was _down_, and the \"rising lag\" is it draining the backlog.\n4. `query-logs` for `service.name = logs-ingestion` (and its neighbors) around 20:00–20:15 → process exit + restart lines at the gap boundaries.\n5. Conclusion: consumer outage 20:01–20:10 (restart visible in logs); lag spike is backlog drain, self-recovering; affected signal: logs freshness only — no data loss (topic retained messages). Evidence: zero throughput during the window, message-age spike equal to outage duration, restart log lines.\n\n## Pitfalls\n\n- Counters reset on process restart — `rate`\u002F`increase` already handle this; never eyeball raw cumulative counter values.\n- A metric that stops reporting is not \"zero\" — a gap in `series` with `top_movers` showing a vanished label value means the _emitter_ died; pivot to logs immediately.\n- Don't trust a single aggregation: a flat `avg` can hide a screaming `p95`. For latency-like gauges and histograms, characterize the tail too.\n- Scraped Prometheus metrics arrive ~15–60s behind real time; don't read the last bucket of a series as \"current\".\n",{"data":53,"body":54},{"name":4,"description":6},{"type":55,"children":56},"root",[57,65,93,100,107,199,205,226,336,342,355,413,419,436,513,519,524,530,654,660],{"type":58,"tag":59,"props":60,"children":61},"element","h1",{"id":4},[62],{"type":63,"value":64},"text","Investigating metric anomalies",{"type":58,"tag":66,"props":67,"children":68},"p",{},[69,71,77,79,84,86,91],{"type":63,"value":70},"The job: go from a metric symptom (\"ingestion lag is rising\") to a probable cause with evidence, fast. The metric tells you ",{"type":58,"tag":72,"props":73,"children":74},"em",{},[75],{"type":63,"value":76},"what",{"type":63,"value":78}," and ",{"type":58,"tag":72,"props":80,"children":81},{},[82],{"type":63,"value":83},"when",{"type":63,"value":85},"; logs and traces tell you ",{"type":58,"tag":72,"props":87,"children":88},{},[89],{"type":63,"value":90},"why",{"type":63,"value":92},". Follow the loop below — it front-loads the cheap, high-information calls and only fans out when the blast radius is unclear.",{"type":58,"tag":94,"props":95,"children":97},"h2",{"id":96},"the-loop",[98],{"type":63,"value":99},"The loop",{"type":58,"tag":101,"props":102,"children":104},"h3",{"id":103},"_1-pin-down-the-metric",[105],{"type":63,"value":106},"1. Pin down the metric",{"type":58,"tag":66,"props":108,"children":109},{},[110,112,119,121,127,129,135,136,142,143,149,151,157,159,165,167,173,175,181,183,189,191,197],{"type":63,"value":111},"If you have the exact metric name, skip ahead. Otherwise call ",{"type":58,"tag":113,"props":114,"children":116},"code",{"className":115},[],[117],{"type":63,"value":118},"metric-names-list",{"type":63,"value":120}," with a substring from the symptom (",{"type":58,"tag":113,"props":122,"children":124},{"className":123},[],[125],{"type":63,"value":126},"lag",{"type":63,"value":128},", ",{"type":58,"tag":113,"props":130,"children":132},{"className":131},[],[133],{"type":63,"value":134},"error",{"type":63,"value":128},{"type":58,"tag":113,"props":137,"children":139},{"className":138},[],[140],{"type":63,"value":141},"latency",{"type":63,"value":128},{"type":58,"tag":113,"props":144,"children":146},{"className":145},[],[147],{"type":63,"value":148},"queue",{"type":63,"value":150},"). The returned ",{"type":58,"tag":113,"props":152,"children":154},{"className":153},[],[155],{"type":63,"value":156},"metric_type",{"type":63,"value":158}," decides the lens: counters (",{"type":58,"tag":113,"props":160,"children":162},{"className":161},[],[163],{"type":63,"value":164},"sum",{"type":63,"value":166},") are only meaningful as ",{"type":58,"tag":113,"props":168,"children":170},{"className":169},[],[171],{"type":63,"value":172},"rate",{"type":63,"value":174},"\u002F",{"type":58,"tag":113,"props":176,"children":178},{"className":177},[],[179],{"type":63,"value":180},"increase",{"type":63,"value":182},", gauges as ",{"type":58,"tag":113,"props":184,"children":186},{"className":185},[],[187],{"type":63,"value":188},"avg",{"type":63,"value":190},", histograms as ",{"type":58,"tag":113,"props":192,"children":194},{"className":193},[],[195],{"type":63,"value":196},"histogram_quantile",{"type":63,"value":198},".",{"type":58,"tag":101,"props":200,"children":202},{"id":201},"_2-characterize-first-one-call-three-answers",[203],{"type":63,"value":204},"2. Characterize first — one call, three answers",{"type":58,"tag":66,"props":206,"children":207},{},[208,210,216,218,224],{"type":63,"value":209},"Call ",{"type":58,"tag":113,"props":211,"children":213},{"className":212},[],[214],{"type":63,"value":215},"characterize-metric-anomaly",{"type":63,"value":217}," with the metric name and ",{"type":58,"tag":113,"props":219,"children":221},{"className":220},[],[222],{"type":63,"value":223},"anomalyFrom",{"type":63,"value":225}," (the alert fire time, or when the user says it started looking wrong; subtract some margin if unsure). It compares against the preceding window by default and answers:",{"type":58,"tag":227,"props":228,"children":229},"ul",{},[230,302,319],{"type":58,"tag":231,"props":232,"children":233},"li",{},[234,240,242,248,249,255,256,262,264,270,272,277,279,285,287,293,294,300],{"type":58,"tag":235,"props":236,"children":237},"strong",{},[238],{"type":63,"value":239},"How bad:",{"type":63,"value":241}," ",{"type":58,"tag":113,"props":243,"children":245},{"className":244},[],[246],{"type":63,"value":247},"direction",{"type":63,"value":128},{"type":58,"tag":113,"props":250,"children":252},{"className":251},[],[253],{"type":63,"value":254},"change_ratio",{"type":63,"value":128},{"type":58,"tag":113,"props":257,"children":259},{"className":258},[],[260],{"type":63,"value":261},"anomaly_peak",{"type":63,"value":263}," vs ",{"type":58,"tag":113,"props":265,"children":267},{"className":266},[],[268],{"type":63,"value":269},"baseline_mean",{"type":63,"value":271},". If ",{"type":58,"tag":113,"props":273,"children":275},{"className":274},[],[276],{"type":63,"value":247},{"type":63,"value":278}," is ",{"type":58,"tag":113,"props":280,"children":282},{"className":281},[],[283],{"type":63,"value":284},"flat",{"type":63,"value":286},", your window or metric is wrong — widen the window, or compare against the same window yesterday via ",{"type":58,"tag":113,"props":288,"children":290},{"className":289},[],[291],{"type":63,"value":292},"baselineFrom",{"type":63,"value":174},{"type":58,"tag":113,"props":295,"children":297},{"className":296},[],[298],{"type":63,"value":299},"baselineTo",{"type":63,"value":301}," (daily-pattern metrics often look \"anomalous\" against the immediately-preceding hours).",{"type":58,"tag":231,"props":303,"children":304},{},[305,310,311,317],{"type":58,"tag":235,"props":306,"children":307},{},[308],{"type":63,"value":309},"When:",{"type":63,"value":241},{"type":58,"tag":113,"props":312,"children":314},{"className":313},[],[315],{"type":63,"value":316},"onset_time",{"type":63,"value":318}," — treat this timestamp as the pivot for everything that follows.",{"type":58,"tag":231,"props":320,"children":321},{},[322,327,328,334],{"type":58,"tag":235,"props":323,"children":324},{},[325],{"type":63,"value":326},"Where:",{"type":63,"value":241},{"type":58,"tag":113,"props":329,"children":331},{"className":330},[],[332],{"type":63,"value":333},"top_movers",{"type":63,"value":335}," — label values whose behavior changed. One mover (a single pod, shard, or endpoint) means a localized culprit; everything moving together means a shared cause (an upstream dependency, a deploy, infra).",{"type":58,"tag":101,"props":337,"children":339},{"id":338},"_3-sharpen-with-targeted-metric-queries",[340],{"type":63,"value":341},"3. Sharpen with targeted metric queries",{"type":58,"tag":66,"props":343,"children":344},{},[345,347,353],{"type":63,"value":346},"Use ",{"type":58,"tag":113,"props":348,"children":350},{"className":349},[],[351],{"type":63,"value":352},"query-metrics",{"type":63,"value":354}," to test the hypotheses the report raises:",{"type":58,"tag":227,"props":356,"children":357},{},[358,371,400],{"type":58,"tag":231,"props":359,"children":360},{},[361,363,369],{"type":63,"value":362},"Drill a mover: re-query with ",{"type":58,"tag":113,"props":364,"children":366},{"className":365},[],[367],{"type":63,"value":368},"filters",{"type":63,"value":370}," pinning the suspicious label value, grouped by a second key, to localize further (pod → container, endpoint → status code).",{"type":58,"tag":231,"props":372,"children":373},{},[374,376,382,384,390,392,398],{"type":63,"value":375},"Normalize: a rising error count means nothing if traffic doubled — use ",{"type":58,"tag":113,"props":377,"children":379},{"className":378},[],[380],{"type":63,"value":381},"clauses",{"type":63,"value":383}," + ",{"type":58,"tag":113,"props":385,"children":387},{"className":386},[],[388],{"type":63,"value":389},"formula",{"type":63,"value":391}," (",{"type":58,"tag":113,"props":393,"children":395},{"className":394},[],[396],{"type":63,"value":397},"errors \u002F requests",{"type":63,"value":399},") to separate rate changes from volume changes.",{"type":58,"tag":231,"props":401,"children":402},{},[403,405,411],{"type":63,"value":404},"Check the neighbors: query the obvious companion metrics over the same window (for lag: throughput and error counters of the same service; for latency: request rate and saturation gauges). Use the same ",{"type":58,"tag":113,"props":406,"children":408},{"className":407},[],[409],{"type":63,"value":410},"interval",{"type":63,"value":412}," so the grids align visually.",{"type":58,"tag":101,"props":414,"children":416},{"id":415},"_4-correlate-across-signals-at-the-onset",[417],{"type":63,"value":418},"4. Correlate across signals at the onset",{"type":58,"tag":66,"props":420,"children":421},{},[422,424,434],{"type":63,"value":423},"Pivot into logs and traces using the ",{"type":58,"tag":235,"props":425,"children":426},{},[427,429],{"type":63,"value":428},"same service and a window bracketing ",{"type":58,"tag":113,"props":430,"children":432},{"className":431},[],[433],{"type":63,"value":316},{"type":63,"value":435}," (a few buckets before, through the peak):",{"type":58,"tag":227,"props":437,"children":438},{},[439,480],{"type":58,"tag":231,"props":440,"children":441},{},[442,447,449,455,457,463,465,470,472,478],{"type":58,"tag":235,"props":443,"children":444},{},[445],{"type":63,"value":446},"Logs:",{"type":63,"value":448}," use ",{"type":58,"tag":113,"props":450,"children":452},{"className":451},[],[453],{"type":63,"value":454},"query-logs",{"type":63,"value":456}," (follow its own discover-first workflow) filtered to the implicated ",{"type":58,"tag":113,"props":458,"children":460},{"className":459},[],[461],{"type":63,"value":462},"service.name",{"type":63,"value":464}," and window, severity ",{"type":58,"tag":113,"props":466,"children":468},{"className":467},[],[469],{"type":63,"value":134},{"type":63,"value":471}," first, then ",{"type":58,"tag":113,"props":473,"children":475},{"className":474},[],[476],{"type":63,"value":477},"warn",{"type":63,"value":479},". Restarts, crash loops, connection errors, and deploy markers right before onset are the classic causes. Widen to other services in the request path if the service's own logs are clean.",{"type":58,"tag":231,"props":481,"children":482},{},[483,488,490,496,498,503,505,511],{"type":58,"tag":235,"props":484,"children":485},{},[486],{"type":63,"value":487},"Traces:",{"type":63,"value":489}," use the APM span tools (",{"type":58,"tag":113,"props":491,"children":493},{"className":492},[],[494],{"type":63,"value":495},"query-apm-spans",{"type":63,"value":497}," etc.) for the same service\u002Fwindow — slow or erroring spans show ",{"type":58,"tag":72,"props":499,"children":500},{},[501],{"type":63,"value":502},"which dependency",{"type":63,"value":504}," degraded, and a ",{"type":58,"tag":113,"props":506,"children":508},{"className":507},[],[509],{"type":63,"value":510},"trace_id",{"type":63,"value":512}," from an exemplar or log line links a concrete request across all three signals.",{"type":58,"tag":101,"props":514,"children":516},{"id":515},"_5-conclude-with-evidence-not-vibes",[517],{"type":63,"value":518},"5. Conclude with evidence, not vibes",{"type":58,"tag":66,"props":520,"children":521},{},[522],{"type":63,"value":523},"State: the symptom (metric, magnitude, onset), the probable cause (what you found in logs\u002Ftraces and how its timing aligns with the onset), the blast radius (which services\u002Flabels are affected, from the movers and grouped queries), and the confidence level. If the cause is still ambiguous, say which hypothesis the evidence favors and what would disambiguate (e.g. \"the lag began draining at 20:12 — consistent with a consumer restart; check who restarted it\").",{"type":58,"tag":94,"props":525,"children":527},{"id":526},"worked-example-ingestion-lag-is-rising-why",[528],{"type":63,"value":529},"Worked example: \"ingestion lag is rising — why?\"",{"type":58,"tag":531,"props":532,"children":533},"ol",{},[534,560,600,631,649],{"type":58,"tag":231,"props":535,"children":536},{},[537,542,544,550,552,558],{"type":58,"tag":113,"props":538,"children":540},{"className":539},[],[541],{"type":63,"value":118},{"type":63,"value":543}," with ",{"type":58,"tag":113,"props":545,"children":547},{"className":546},[],[548],{"type":63,"value":549},"value: \"lag\"",{"type":63,"value":551}," → ",{"type":58,"tag":113,"props":553,"children":555},{"className":554},[],[556],{"type":63,"value":557},"logs_rate_limiter_message_lag_seconds",{"type":63,"value":559}," (histogram) and friends.",{"type":58,"tag":231,"props":561,"children":562},{},[563,568,570,575,577,583,585,590,592,598],{"type":58,"tag":113,"props":564,"children":566},{"className":565},[],[567],{"type":63,"value":215},{"type":63,"value":569}," on it with ",{"type":58,"tag":113,"props":571,"children":573},{"className":572},[],[574],{"type":63,"value":223},{"type":63,"value":576}," = alert time → direction ",{"type":58,"tag":113,"props":578,"children":580},{"className":579},[],[581],{"type":63,"value":582},"up",{"type":63,"value":584},", change ratio 40x, ",{"type":58,"tag":113,"props":586,"children":588},{"className":587},[],[589],{"type":63,"value":316},{"type":63,"value":591}," 20:10, top mover ",{"type":58,"tag":113,"props":593,"children":595},{"className":594},[],[596],{"type":63,"value":597},"service_name = logs-ingestion",{"type":63,"value":599}," (the other services' lag stayed flat) — so the logs consumer specifically is behind, not the whole pipeline.",{"type":58,"tag":231,"props":601,"children":602},{},[603,608,610,615,617,622,624,629],{"type":58,"tag":113,"props":604,"children":606},{"className":605},[],[607],{"type":63,"value":352},{"type":63,"value":609},": ",{"type":58,"tag":113,"props":611,"children":613},{"className":612},[],[614],{"type":63,"value":172},{"type":63,"value":616}," of the consumer's throughput counter over the same window → throughput was ",{"type":58,"tag":235,"props":618,"children":619},{},[620],{"type":63,"value":621},"zero",{"type":63,"value":623}," during the gap and spiked after onset: the consumer wasn't slow, it was ",{"type":58,"tag":72,"props":625,"children":626},{},[627],{"type":63,"value":628},"down",{"type":63,"value":630},", and the \"rising lag\" is it draining the backlog.",{"type":58,"tag":231,"props":632,"children":633},{},[634,639,641,647],{"type":58,"tag":113,"props":635,"children":637},{"className":636},[],[638],{"type":63,"value":454},{"type":63,"value":640}," for ",{"type":58,"tag":113,"props":642,"children":644},{"className":643},[],[645],{"type":63,"value":646},"service.name = logs-ingestion",{"type":63,"value":648}," (and its neighbors) around 20:00–20:15 → process exit + restart lines at the gap boundaries.",{"type":58,"tag":231,"props":650,"children":651},{},[652],{"type":63,"value":653},"Conclusion: consumer outage 20:01–20:10 (restart visible in logs); lag spike is backlog drain, self-recovering; affected signal: logs freshness only — no data loss (topic retained messages). Evidence: zero throughput during the window, message-age spike equal to outage duration, restart log lines.",{"type":58,"tag":94,"props":655,"children":657},{"id":656},"pitfalls",[658],{"type":63,"value":659},"Pitfalls",{"type":58,"tag":227,"props":661,"children":662},{},[663,681,707,727],{"type":58,"tag":231,"props":664,"children":665},{},[666,668,673,674,679],{"type":63,"value":667},"Counters reset on process restart — ",{"type":58,"tag":113,"props":669,"children":671},{"className":670},[],[672],{"type":63,"value":172},{"type":63,"value":174},{"type":58,"tag":113,"props":675,"children":677},{"className":676},[],[678],{"type":63,"value":180},{"type":63,"value":680}," already handle this; never eyeball raw cumulative counter values.",{"type":58,"tag":231,"props":682,"children":683},{},[684,686,692,693,698,700,705],{"type":63,"value":685},"A metric that stops reporting is not \"zero\" — a gap in ",{"type":58,"tag":113,"props":687,"children":689},{"className":688},[],[690],{"type":63,"value":691},"series",{"type":63,"value":543},{"type":58,"tag":113,"props":694,"children":696},{"className":695},[],[697],{"type":63,"value":333},{"type":63,"value":699}," showing a vanished label value means the ",{"type":58,"tag":72,"props":701,"children":702},{},[703],{"type":63,"value":704},"emitter",{"type":63,"value":706}," died; pivot to logs immediately.",{"type":58,"tag":231,"props":708,"children":709},{},[710,712,717,719,725],{"type":63,"value":711},"Don't trust a single aggregation: a flat ",{"type":58,"tag":113,"props":713,"children":715},{"className":714},[],[716],{"type":63,"value":188},{"type":63,"value":718}," can hide a screaming ",{"type":58,"tag":113,"props":720,"children":722},{"className":721},[],[723],{"type":63,"value":724},"p95",{"type":63,"value":726},". For latency-like gauges and histograms, characterize the tail too.",{"type":58,"tag":231,"props":728,"children":729},{},[730],{"type":63,"value":731},"Scraped Prometheus metrics arrive ~15–60s behind real time; don't read the last bucket of a series as \"current\".",{"items":733,"total":896},[734,748,760,772,785,796,812,829,843,858,868,886],{"slug":735,"name":735,"fn":736,"description":737,"org":738,"tags":739,"stars":26,"repoUrl":27,"updatedAt":747},"analyzing-expensive-users","analyze expensive users in AI observability","Analyze the most expensive users in AI observability and explain why they cost so much. Use when the user asks about top spenders, expensive users, per-user LLM cost, user-level cost drivers, or patterns behind high AI observability spend.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[740,742,745,746],{"name":741,"slug":34,"type":15},"Analytics",{"name":743,"slug":744,"type":15},"Cost Optimization","cost-optimization",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-07-28T05:34:11.117757",{"slug":749,"name":749,"fn":750,"description":751,"org":752,"tags":753,"stars":26,"repoUrl":27,"updatedAt":759},"auditing-endpoints","audit PostHog project endpoints","Audit every endpoint in a PostHog project for staleness, failed materialisations, and unused materialised versions. Use when the user asks \"what endpoints can I clean up?\", \"are any of my endpoints broken?\", \"which materialised versions are still being called?\", or wants a one-shot cleanup pass over the Endpoints product. Produces a prioritised report grouped by issue type, with recommended actions but does not modify anything without explicit confirmation.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[754,755,758],{"name":741,"slug":34,"type":15},{"name":756,"slug":757,"type":15},"Audit","audit",{"name":9,"slug":8,"type":15},"2026-06-08T08:08:33.693989",{"slug":761,"name":761,"fn":762,"description":763,"org":764,"tags":765,"stars":26,"repoUrl":27,"updatedAt":771},"auditing-warehouse-source-health","audit PostHog data warehouse source health","Audit the health of a PostHog project's data warehouse sources and syncs — find every broken or degraded source connection, sync schema, and webhook channel. Use when the user asks \"why are my imports failing?\", \"what's broken with my sources?\", \"why is my warehouse data stale?\", or wants a one-shot triage of source\u002Fsync health before deciding where to dig in. Produces a prioritized report grouped by severity, with recommended next steps. For materialized-view health use `auditing-warehouse-view-health`; for a single failing sync use `diagnosing-failed-warehouse-syncs`.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[766,767,769,770],{"name":756,"slug":757,"type":15},{"name":768,"slug":36,"type":15},"Data Warehouse",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-06-18T08:22:57.67984",{"slug":773,"name":773,"fn":774,"description":775,"org":776,"tags":777,"stars":26,"repoUrl":27,"updatedAt":784},"auditing-warehouse-view-health","audit PostHog materialized view health","Audit the health of a PostHog project's materialized views (saved queries) — find every failed materialization and flag unused or stale materialized views that cost storage and compute. Use when the user asks \"which of my views are broken?\", \"why is this materialized view failing?\", \"are any of my views wasting compute?\", or wants a one-shot triage of view health. For source\u002Fsync health use `auditing-warehouse-source-health`.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[778,779,780,783],{"name":756,"slug":757,"type":15},{"name":768,"slug":36,"type":15},{"name":781,"slug":782,"type":15},"Performance","performance",{"name":9,"slug":8,"type":15},"2026-06-18T08:25:10.936787",{"slug":786,"name":786,"fn":787,"description":788,"org":789,"tags":790,"stars":26,"repoUrl":27,"updatedAt":795},"authoring-error-tracking-alerts","author PostHog error tracking alerts","Author error tracking alerts that fire when an issue is created, reopened, or starts spiking. Use when the user asks to set up error notifications, route exceptions to Slack\u002Fwebhook\u002FLinear, or evaluate which error events are worth alerting on. Covers trigger-event selection, integration choice, dedup against existing alerts, and shipping with the canonical message body shape.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[791,792,793,794],{"name":17,"slug":18,"type":15},{"name":24,"slug":25,"type":15},{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-06-18T08:24:40.318583",{"slug":797,"name":797,"fn":798,"description":799,"org":800,"tags":801,"stars":26,"repoUrl":27,"updatedAt":811},"authoring-log-alerts","author log alerts in PostHog","Author useful, low-noise log alerts on services in a PostHog project. Use when the user asks to set up alerts for their logs, suggest alerts they should add, or evaluate whether a service is worth monitoring. Covers service triage, baseline characterisation, threshold drafting, back-testing via simulate, and shipping with a notification destination.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[802,803,806,807,810],{"name":741,"slug":34,"type":15},{"name":804,"slug":805,"type":15},"Monitoring","monitoring",{"name":13,"slug":14,"type":15},{"name":808,"slug":809,"type":15},"Operations","operations",{"name":9,"slug":8,"type":15},"2026-07-18T05:10:54.430898",{"slug":813,"name":813,"fn":814,"description":815,"org":816,"tags":817,"stars":26,"repoUrl":27,"updatedAt":828},"building-workflows","build and edit PostHog workflows","Build, edit, test, enable, and monitor PostHog workflows over MCP. Author the action\u002Fedge graph so it runs and opens cleanly in the visual editor, then change drafts surgically with patch operations. Use when asked to build, set up, automate, change, fix, or debug a workflow, campaign, broadcast, drip sequence, or event-triggered automation in the workflows product.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[818,821,824,825],{"name":819,"slug":820,"type":15},"Automation","automation",{"name":822,"slug":823,"type":15},"MCP","mcp",{"name":9,"slug":8,"type":15},{"name":826,"slug":827,"type":15},"Workflow Automation","workflow-automation","2026-07-28T05:34:12.167015",{"slug":830,"name":830,"fn":831,"description":832,"org":833,"tags":834,"stars":26,"repoUrl":27,"updatedAt":842},"check-posthog-loading","inspect PostHog SDK loading across URLs","Inspect how the PostHog JavaScript SDK is loaded across a list of URLs. Use to confirm consistent installation across pages, find pages missing the snippet, detect mismatched API keys or hosts between pages, and verify the load method (head snippet vs deferred vs array.js).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[835,836,837,840,841],{"name":741,"slug":34,"type":15},{"name":24,"slug":25,"type":15},{"name":838,"slug":839,"type":15},"Frontend","frontend",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},"2026-05-07T05:56:19.828048",{"slug":844,"name":844,"fn":845,"description":846,"org":847,"tags":848,"stars":26,"repoUrl":27,"updatedAt":857},"consuming-endpoints-from-client-code","integrate PostHog endpoints into client applications","Wire a PostHog endpoint into a client app or SDK. Covers fetching the OpenAPI spec, generating a typed client with openapi-generator or @hey-api\u002Fopenapi-ts, sending the right auth header, shaping the variables payload (HogQL code_name vs insight breakdown property), handling rate-limit and materialised-endpoint error responses. Use when the user says \"how do I call my endpoint\", \"generate a client for this\", or \"what auth header do I use\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[849,852,853,854],{"name":850,"slug":851,"type":15},"API Development","api-development",{"name":838,"slug":839,"type":15},{"name":9,"slug":8,"type":15},{"name":855,"slug":856,"type":15},"SDK","sdk","2026-06-08T08:08:34.929454",{"slug":859,"name":859,"fn":860,"description":861,"org":862,"tags":863,"stars":26,"repoUrl":27,"updatedAt":867},"copying-endpoints-across-projects","copy PostHog endpoints across projects","Copy a PostHog endpoint (a saved HogQL\u002Finsight query exposed as an API route) to another project in the same organization, or duplicate it under a new name in the same project. Use when the user wants to duplicate an endpoint, promote an endpoint from staging to production, replicate an endpoint's query\u002Fvariables\u002Ffreshness config in another workspace, or clone an endpoint to iterate on it. Unlike feature flags and experiments, endpoints have NO native cross-project copy tool — this skill covers the read-then-recreate flow (endpoint-get then endpoint-create), the active-project switching it requires, name-collision checks, and the safe defaults (land unmaterialised in the target, verify with endpoint-run). Does not cover editing endpoint versions (see managing-endpoint-versions) or authoring a brand-new endpoint from scratch (see creating-an-endpoint).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[864,865,866],{"name":850,"slug":851,"type":15},{"name":808,"slug":809,"type":15},{"name":9,"slug":8,"type":15},"2026-07-15T05:29:58.442727",{"slug":869,"name":869,"fn":870,"description":871,"org":872,"tags":873,"stars":26,"repoUrl":27,"updatedAt":885},"creating-ai-subscription","schedule recurring AI-generated PostHog reports","Create a recurring AI-generated PostHog report — schedule a free-text prompt to run on a cron, with the LLM-synthesized markdown delivered to email or Slack on each tick. Use when the user wants a recurring AI summary of X on any cadence (daily, weekly, monthly, yearly) rather than a one-off report. (To attach an AI summary to an existing insight\u002Fdashboard subscription instead of a free-text prompt, see `managing-subscriptions` and its `summary_enabled` option.)\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[874,875,878,879,882],{"name":819,"slug":820,"type":15},{"name":876,"slug":877,"type":15},"Email","email",{"name":9,"slug":8,"type":15},{"name":880,"slug":881,"type":15},"Reporting","reporting",{"name":883,"slug":884,"type":15},"Slack","slack","2026-06-09T07:32:27.935712",{"slug":887,"name":887,"fn":888,"description":889,"org":890,"tags":891,"stars":26,"repoUrl":27,"updatedAt":895},"creating-an-endpoint","create PostHog API endpoints","Create a PostHog endpoint with the right shape on the first try — covers query kind choice, name conventions, what to expose as variables (HogQL code_name vs insight breakdown), data_freshness_seconds, and whether to materialise on day one. Use when the user says \"create an endpoint\", \"expose this query as an API\", \"turn this insight into an endpoint\", or asks for help structuring a new endpoint. Steers away from common mistakes: materialising a query with cohort breakdowns or compare mode, inline-only variables on a materialised endpoint, unbounded date ranges, ambiguous names.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[892,893,894],{"name":741,"slug":34,"type":15},{"name":850,"slug":851,"type":15},{"name":9,"slug":8,"type":15},"2026-06-08T08:08:29.624498",231,{"items":898,"total":948},[899,906,912,919,926,933,941],{"slug":735,"name":735,"fn":736,"description":737,"org":900,"tags":901,"stars":26,"repoUrl":27,"updatedAt":747},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[902,903,904,905],{"name":741,"slug":34,"type":15},{"name":743,"slug":744,"type":15},{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},{"slug":749,"name":749,"fn":750,"description":751,"org":907,"tags":908,"stars":26,"repoUrl":27,"updatedAt":759},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[909,910,911],{"name":741,"slug":34,"type":15},{"name":756,"slug":757,"type":15},{"name":9,"slug":8,"type":15},{"slug":761,"name":761,"fn":762,"description":763,"org":913,"tags":914,"stars":26,"repoUrl":27,"updatedAt":771},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[915,916,917,918],{"name":756,"slug":757,"type":15},{"name":768,"slug":36,"type":15},{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},{"slug":773,"name":773,"fn":774,"description":775,"org":920,"tags":921,"stars":26,"repoUrl":27,"updatedAt":784},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[922,923,924,925],{"name":756,"slug":757,"type":15},{"name":768,"slug":36,"type":15},{"name":781,"slug":782,"type":15},{"name":9,"slug":8,"type":15},{"slug":786,"name":786,"fn":787,"description":788,"org":927,"tags":928,"stars":26,"repoUrl":27,"updatedAt":795},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[929,930,931,932],{"name":17,"slug":18,"type":15},{"name":24,"slug":25,"type":15},{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},{"slug":797,"name":797,"fn":798,"description":799,"org":934,"tags":935,"stars":26,"repoUrl":27,"updatedAt":811},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[936,937,938,939,940],{"name":741,"slug":34,"type":15},{"name":804,"slug":805,"type":15},{"name":13,"slug":14,"type":15},{"name":808,"slug":809,"type":15},{"name":9,"slug":8,"type":15},{"slug":813,"name":813,"fn":814,"description":815,"org":942,"tags":943,"stars":26,"repoUrl":27,"updatedAt":828},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[944,945,946,947],{"name":819,"slug":820,"type":15},{"name":822,"slug":823,"type":15},{"name":9,"slug":8,"type":15},{"name":826,"slug":827,"type":15},61]