Skill

resolving-ingestion-warnings

Name: resolving-ingestion-warnings
Author: PostHog

resolve PostHog ingestion warnings

Published by PostHog Updated Jul 10

Covers Observability PostHog Data Engineering Debugging

Description

Diagnoses and resolves PostHog ingestion warnings — problems recorded while ingesting events (dropped events, rejected person merges, oversized payloads, invalid data). Use when a user asks why events are missing, dropped, or undercounted, why identify/alias calls don't work or accounts stay duplicated, why person or group properties aren't updating or profiles look inflated, why recordings have gaps, heatmaps are empty, LLM token counts are missing, why cookieless events vanish, or whenever `posthog:ingestion-warnings-list` returns results. Explains severity triage (error = dropped, warning = modified, info = intentional) and routes all warning types — size limits and enrichment, merges and distinct IDs, `$process_person_profile`, timestamps, cookieless, heatmaps, transformations, session replay — to per-issue reference files with code-level causes and per-SDK fixes.

SKILL.md

Resolving ingestion warnings

Ingestion warnings record problems PostHog hit while ingesting a project's events. They are the first place to look when events are missing, counts are lower than expected, or identify/merge calls don't behave.

Workflow

List the warnings: call posthog:ingestion-warnings-list (defaults to the last 24h; widen with since: '-7d', narrow with severity or type). Each entry has a count, a sparkline, and recent samples with the affected event_uuid / distinct_id / person_id / group_key.
Triage by severity — it encodes what happened to the data:
- error — the event or update was dropped. Data loss; fix these first.
- warning — ingested, but modified or partially rejected.
- info — informational, or an intentional, team-configured drop.
Route by type using the table below. Where a references/fixing-*.md file exists, read it — it has the full diagnosis and per-SDK fixes; load only the file you need.
Verify any fix the same way: re-run the affected flow, re-query posthog:ingestion-warnings-list with a since after the fix, and confirm the type's count stops growing. Warnings are debounced per team+type+key, so judge by "no new occurrences", not by historical counts shrinking.

One identity caveat that applies throughout: distinct IDs are not persons. An identified user usually has several distinct IDs mapping to one person; resolve sampled distinct IDs to persons (posthog:persons-list) before reasoning about patterns.

A second cross-cutting check: SDK version clustering. Pull $lib / $lib_version from the affected events and compare against unaffected traffic — warnings concentrating on old SDK versions or one platform usually mean an outdated or pinned SDK, and the fix is an upgrade rather than payload surgery.

Warning types and fixes

Size (`size`)

Type	What happened	Fix
`message_size_too_large`	Event dropped: >1MB after person/group properties were copied onto it	Read references/fixing-message-size-too-large.md — covers the enrichment mechanism, diagnosis, and per-SDK fixes
`person_properties_size_violation`	A person-properties update was rejected: the person's stored properties would exceed the limit	Read references/fixing-person-properties-size-violation.md — covers the three growth patterns, the code fix, and the user-approved `$unset` cleanup
`person_upsert_message_size_too_large`	A person update was too large to persist	Same root cause and fix as `person_properties_size_violation`
`group_upsert_message_size_too_large`	A group update was too large to persist	Trim `$group_set` payloads; groups should carry bounded metadata, not documents
`group_key_too_long`	`$groupidentify` dropped: group key over 400 chars	Read references/fixing-group-key-too-long.md — a payload/token was passed where the group ID belongs

Person merges (`merge`)

Type	What happened	Fix
`cannot_merge_already_identified`	Merge refused: both persons are already identified. The accounts silently stayed separate	Read references/fixing-cannot-merge-already-identified.md — covers the identify/reset flow fixes; joining two identified users is a manual one-off decision, never application code
`cannot_merge_with_illegal_distinct_id`	Merge refused: the distinct ID is a placeholder (`undefined`, `null`, `[object Object]`, `anonymous`, …)	Read references/fixing-invalid-distinct-ids.md — a variable is unset at the identify/alias callsite
`merge_race_condition`	Concurrent merges collided on the same persons; the operation was dropped	Read references/fixing-merge-race-condition.md — dedupe parallel identify calls, and check for a "mega person" merge magnet (thousands of distinct IDs on one person)

Event validation (`event`)

Type	What happened	Fix
`client_ingestion_warning`	The SDK itself reported a problem	Read `details.message` — the SDK wrote the diagnosis at the moment it caught the misuse (e.g. an invalid group key). Never debounced (like `merge_race_condition`), so counts are true counts; group by message and map each back to the misused SDK call
`ignored_invalid_timestamp`	`timestamp` didn't parse; the event was kept with the server time	Read references/fixing-ignored-invalid-timestamp.md — send ISO 8601; the event was kept at server time
`schema_validation_failed`	Event dropped: it violates a schema the team enforces for that event	Compare `details.errors` against the payload; align the code or update the schema
`skipping_event_invalid_distinct_id`	Event dropped: distinct ID over 400 chars	Read references/fixing-invalid-distinct-ids.md — a token/payload was passed as the distinct ID
`invalid_ai_token_property`	An `$ai_*` token property wasn't numeric; it was nulled	Read references/fixing-invalid-ai-token-property.md — token counts must be plain numbers
`invalid_process_person_profile`	`$process_person_profile` wasn't boolean; the default (true) was used	Read references/fixing-process-person-profile-warnings.md — a stringified boolean silently opts back into person processing
`invalid_event_when_process_person_profile_is_false`	`$identify`/`$create_alias`/`$merge_dangerously`/`$groupidentify` dropped because the event disabled person processing	Read references/fixing-process-person-profile-warnings.md — identity events require person processing
`event_dropped_too_old`	Intentional: the event is older than the team's configured drop threshold	Read references/fixing-event-dropped-too-old.md — mind mobile SDKs: offline queues legitimately deliver days-old events; threshold changes are the user's call
`cookieless_missing_timestamp` / `cookieless_timestamp_out_of_range` / `cookieless_missing_user_agent` / `cookieless_missing_ip` / `cookieless_missing_host`	Cookieless-mode event dropped: a field required to compute the cookieless ID was missing or invalid	Read references/fixing-cookieless-warnings.md — the missing field identifies the broken layer; beware the silent variant where a server relay omits $ip and users collapse onto the server's IP

Heatmaps (`event`)

Type	What happened	Fix
`invalid_heatmap_data`	`$heatmap_data` didn't parse; the heatmap portion was dropped (event survived)	Read references/fixing-invalid-heatmap-data.md — the whole payload failed to parse; event survived, heatmap data lost
`rejecting_heatmap_data_with_invalid_url`	Heatmap entry keyed by an invalid URL	Read references/fixing-invalid-heatmap-data.md — the entry key (page URL) was empty or not a string
`rejecting_heatmap_data_with_invalid_items`	Heatmap URL mapped to a non-array	Read references/fixing-invalid-heatmap-data.md — each URL key must map to an ARRAY of items

Error tracking (`event`)

Type	What happened	Fix
`error_tracking_exception_processing_errors`	A `$exception` event was ingested but symbolication hit errors	Read `details.errors`; usually missing/mismatched source maps — re-upload them for the release

Transformations (`transformation`)

Type	What happened	Fix
`event_dropped_by_transformation`	A transformation the team configured dropped the event (intentional)	Read references/fixing-event-dropped-by-transformation.md — the details name the exact transformation; edits to it are the user's call

Session replay (`replay`)

Type	What happened	Fix
`replay_lib_version_too_old`	Recording sent by an outdated posthog-js (1.x < 1.75)	Read references/fixing-session-replay-warnings.md — recording still processed; upgrade posthog-js
`message_contained_no_valid_rrweb_events`	A replay message carried no usable snapshot data	Read references/fixing-session-replay-warnings.md — that recording chunk was dropped; usually a rewriting proxy/transport or old SDK
`message_timestamp_diff_too_large`	Replay snapshot timestamps far from arrival time	Read references/fixing-session-replay-warnings.md — chunk dropped at the 7-day threshold; persistent = clock skew, bursts = buffering

resolving-ingestion-warnings

Description

SKILL.md

Resolving ingestion warnings

More from PostHog