Answers 'did my change break anything?' or 'why are errors up?' from an app's logs, by boiling millions of lines down to at most 200 recurring message patterns and comparing them with an earlier, healthy stretch of time.
WHEN TO USE
SCOPE
USE FOR
Check that a service still looks healthy in its logs after a deploy or a settings change.
Explain what is behind a sudden spike in log volume or errors.
During an outage, find which service started failing and which new messages appeared.
Get a quick picture of what an unfamiliar or noisy service is logging.
Find the log lines behind a problem reported elsewhere, such as an alert or a user complaint.
NOT FOR
Creating or tuning log alerts (use authoring-log-alerts).
Questions about product events, people or charts (use querying-posthog-data).
This is a saved copy of the skill's SKILL.md instructions. It may differ from the upstream file or the version you install.
Investigating logs
Investigation is a narrowing problem: summarize before you read.
One posthog:logs-patterns call compresses millions of lines into at most 200 templates,
and one posthog:logs-patterns-diff call answers "what is different about now vs. before" directly.
Raw rows (posthog:query-logs) are the last step of an investigation, never the first.
When to use this skill
"Check the logs" / "is service X healthy?" / "did my deploy (or model bump, config change, migration) break anything?"
"Why are errors up?" / "explain this spike" / incident triage — "what changed?"
"What is this service logging?" — orienting in an unfamiliar or noisy stream.
Finding the log evidence for a failure reported elsewhere (an alert, an error-tracking issue, a user complaint).
When not to use this skill
Creating or tuning log alerts — that's authoring-log-alerts.
Analytics over product events, persons, or insights — that's querying-posthog-data.
HogQL exposes a logs table via posthog:execute-sql, but do not investigate through it:
hand-written SQL over logs routinely hits read-byte caps and re-derives what the tools below do in one cheap call.
Reserve SQL for the rare case of joining log-derived facts with non-log data.
Tools
Tool
Job
posthog:logs-services-create
Top-25 services with log_count, error_count, error_rate, sparkline. Orientation.
posthog:logs-patterns
Mine one window's message templates, ordered by frequency. "What is this stream saying?"
posthog:logs-patterns-diff
Diff templates between two windows: new / rate-shifted / gone. "What changed?"
posthog:logs-count / posthog:logs-count-ranges
Scalar and time-bucketed counts for a filter. Localize volume before pulling rows.
posthog:logs-sparkline-query
Volume over time broken down by severity or service (the one bucketed view with a breakdown).
posthog:logs-facet-values-create
Distribution of severity/service (or a resource attribute) under a filter.
Discover attribute keys and values before building filters.
posthog:query-logs
Raw rows. Endpoint of every drill-down, entry point of none.
Each tool's own description documents its parameters and response shape — read it before calling.
Pick the workflow by question shape
"Is it healthy?" — post-deploy / post-change verification
The user changed something (deploy, model bump, config, migration) and wants to know the logs still look right.
Pin down the change time and the affected service(s). Ask if the user hasn't said; the diff is meaningless without a boundary.
Orient with posthog:logs-services-create: is the service still logging at all, and what is its error_rate now?
A service that went silent fails verification just as hard as one that started erroring.
posthog:logs-patterns-diff with query.dateRange from the change time to now and baselineDateRange
set to a comparable window just before the change, scoped to serviceNames.
New error/fatal templates right after a change are the classic regression signature;
large rate_ratio shifts on existing error templates are the second thing to check.
Check volume continuity with posthog:logs-count-ranges spanning before and after the boundary:
a rate discontinuity (crash loop, restart storm, silence) shows up here even when message content looks unchanged.
Drill only the suspects: pivot each suspicious pattern to raw lines via its match_regex with posthog:query-logs.
A pass verdict needs all three: no new error templates, no large error rate_ratio shifts, and continuous volume.
Say which windows you compared — "healthy" is only as strong as the baseline.
"Explain this spike"
Localize it: posthog:logs-count-ranges over the user's window, then recurse into the dense bucket(s) — each bucket's
date_from/date_to feeds the next call. Stop after 3–4 levels.
Explain it: posthog:logs-patterns-diff with the spike as query.dateRange and the window just before as
baselineDateRange. The top new and rate_shift entries are the explanation. Do not mine both windows
separately and diff by hand — the diff is one call.
Incident triage — "what broke?"
posthog:logs-patterns-diff first: incident window vs. a known-good window just before (or omit the baseline for
same-window-last-week). Suspects are new entries and the biggest rate_ratio shifts; pivot each to raw lines.
If the failing service is unknown, find it first with posthog:logs-facet-values-create faceting service_name
under severityLevels: ["error", "fatal"].
"What is this stream saying?" — unfamiliar service
posthog:logs-patterns over the last hour, scoped to the service. Scan templates by estimated_count and
non-zero error share in severity_counts. Widen the window or add searchTerm only if the answer isn't there.
Known needle — a specific message, attribute, or person
When the target is already precise (an error string, a request id, a distinct_id), skip pattern mining:
discover the right keys with posthog:logs-attributes-list / posthog:logs-attribute-values-list,
size the result with posthog:logs-count, then pull rows with posthog:query-logs.
Rules that keep investigations honest and cheap
Scope serviceNames (or a resource-attribute filter) on every call once the target service is known.
Unscoped calls scan the whole team's stream and starve the pattern sample budget.
posthog:query-logs requires an explicit query.dateRange — omitting it is a 400, not a default window.
Pattern counts are sampled estimates (sampled: true); templates rarer than ~1 in 10,000 rows can be invisible.
Absence of a rare template is not evidence it stopped.
Before trusting a wall of new entries in a diff, check baseline.total_count —
a tiny or empty baseline (logging only just started) makes everything look new.
severityLevels matches the six canonical lowercase buckets against severity_text exactly.
Zero rows on a severity filter → check the stored values with posthog:logs-attribute-values-list { key: "severity_text" }.
Budget: one services call, at most one patterns-diff per window pair, 3–4 count-ranges levels,
and query-logs only for confirmed suspects with limit ≤ 100.
Output
Lead with the verdict, then the evidence:
Verdict: healthy / regressed / inconclusive, with the windows compared.
Suspects (if any): template, classification (new / rate_shift), estimated counts or rate_ratio, services, and 1–2 sample raw lines.
What was checked and what wasn't: services covered, windows, and any sampling or baseline caveats that limit confidence.
The user should be able to act on the verdict without re-running the investigation.
Related skills
authoring-log-alerts — turn the check behind a verdict into a continuous, low-noise alert
exploring-apm-traces — follow a suspicious log line into the request traces around it
MCP connection required
1 FOR YOU
01
Connect the PostHog MCP server to a project that receives your logs
Connect PostHog's MCP server to a project that already ingests your app's logs, so logs-services-create, logs-patterns, logs-patterns-diff, logs-count-ranges and query-logs have data to read.
🔌 This skill ships inside the PostHog AI Plugin. Listed package contents include 3 slash commands, 1 agent, hooks and an MCP server. Installed components and skill versions may vary by AI tool.
Install just this skill
Run this outside your AI tool, using Node.js 22.20.0 or newer. Skills CLI 1.7.2 skips skill selection; prompts cancel installation without an interactive terminal. If choosing Project when asked about installation scope, open your project's folder before running this.
Install checklist
Check selected tools if a picker appears; Claude Code may be unchecked under Additional agents. ↑/↓ moves, Space toggles selections, Enter confirms.
Without a tool picker, check Installing to: for your intended tool. Stop if it names a different tool.
If asked, choose Symlink (Recommended) for shared files or Copy to all agents for separate copies; review the summary before confirming installation.
Install the find-skills skill? defaults to Yes, adding another skill for all projects. Choose No if you don't want that extra installation.
Skills CLI 1.7.2 sends install data to skills.sh by default, including the source, skill names, target tools and file details; GitHub sources are reported only when GitHub confirms the repository is public, while other remote sources can also be reported. Confirmed-public GitHub sources also trigger a security-audit request. Before installing, set the environment variable DO_NOT_TRACK=1 or DISABLE_TELEMETRY=1 to disable both.
After installing for Claude Code, open it in the installation project if you chose Project; Global makes the skill available across projects on this computer. Once Claude Code loads the skill, its description helps Claude decide when to use it.
If installation created a top-level skills folder that did not exist when your Claude Code session started, run /reload-skills in that session. Run it again after later changes in that folder.
MCP server required
The skill's steps call for tools from the PostHog MCP server. Installing just this skill doesn't add that connection; set it up in your AI tool if it isn't there yet: PostHog MCP setup. Installing the whole plugin instead includes the connection settings.
Requirements for the PostHog MCP server
Connecting is free; sign in with your PostHog account.
Some tools use AI internally and may incur PostHog AI charges. Those tools require AI data processing to be enabled in your organization settings.
Install the whole plugin
This route installs the posthog plugin package selected for your AI tool.
Claude Code
Add PostHog's marketplace, then install the plugin
Run both lines in a terminal. They install PostHog's posthog plugin: this skill, PostHog's other skills, and a connection to PostHog's hosted MCP server.
01
claude plugin marketplace add PostHog/ai-plugin
02
claude plugin install posthog@posthog
Installation and loading
The plugin installs for you in every project and loads the next time you start Claude Code, or after /reload-plugins in an open session.
To connect your PostHog account, start claude, type /mcp, select plugin:posthog:posthog and follow the browser prompts.
Good to know
The plugin includes PostHog's session-capture hook; PostHog's README says it sends sessions to LLM Analytics only when POSTHOG_LLMA_CC_ENABLED=true and POSTHOG_API_KEY are both set.
If you use the separate posthog-telemetry plugin, PostHog says to keep only one of the two, because both register the same hook.
On a self-hosted PostHog, this route's MCP connection won't reach your instance: the plugin's config is fixed to https://mcp.posthog.com/mcp, which routes to PostHog's US or EU region. POSTHOG_MCP_URL works only for the Gemini CLI extension.
Sync columns from a synced data warehouse table onto PostHog person or group properties, so warehouse data becomes usable anywhere person and group properties already work: feature flag targeting, cohorts, insight filters and breakdowns, surveys, session replay filters, workflows, and the person profile. Use when the user wants to "add a person property from my warehouse", "enrich people with Stripe/Postgres/Salesforce data", "put ARR or plan tier on my persons", "target a feature flag by a warehouse column", "sync warehouse columns onto groups or organizations", or wants to inspect, backfill, disable, or debug an existing warehouse-backed person or group property.Read full description
Analyze the most expensive users in AI observability and explain why they cost so much. Use when the user asks about top spenders, expensive users, per-user LLM cost, user-level cost drivers, or patterns behind high AI observability spend.Read full description
Analyze session replay patterns across experiment variants to understand user behavior differences. Use when the user wants to see how users interact with different experiment variants, identify usability issues, compare behavior patterns between control and test groups, or get qualitative insights to complement quantitative experiment results. Also covers pairing the observed behavior with a linked survey when the user wants qualitative feedback beyond what recordings show.Read full description
Assesses what a page's heatmap is telling you and recommends concrete changes. Pulls click / rageclick / scroll-depth data for a URL, names the hot elements by cross-referencing autocapture events on the same page, and can create a saved heatmap the user opens in PostHog, then summarizes the behavior and proposes improvements.
TRIGGER when: user asks what a heatmap shows, why people aren't clicking something, where users rage-click, how far they scroll, what to change on a page based on heatmap/click data, or to 'analyze/assess/review the heatmap' for a URL.
DO NOT TRIGGER when: the user only wants to create a saved heatmap screenshot with no analysis (use heatmaps-saved-create directly), or is asking about session replay in general (use investigating-replay).Read full description
Audit every endpoint in a PostHog project for staleness, failed materialisations, and unused materialised versions. Use when the user asks "what endpoints can I clean up?", "are any of my endpoints broken?", "which materialised versions are still being called?", or wants a one-shot cleanup pass over the Endpoints product. Produces a prioritised report grouped by issue type, with recommended actions but does not modify anything without explicit confirmation.Read full description
Audit PostHog experiments and feature flags for configuration issues, staleness, and best-practice violations. Read when the user asks to audit, health-check, or review experiments or feature flags, check flag hygiene, or verify experiment setup.Read full description
