Subchapter 103.9

Example Logs

references/example-logs.mdMarkdown1 KBView on GitHub

Logs (filtering by severity and searching for a term)

Example Logs · Querying PostHog Data · PostHog/skills · Skills Docs

SELECT
    uuid,
    hex(tryBase64Decode(trace_id)),
    hex(tryBase64Decode(span_id)),
    body,
    attributes,
    timestamp,
    observed_timestamp,
    severity_text,
    severity_number,
    severity_text AS level,
    resource_attributes,
    resource_fingerprint,
    instrumentation_scope,
    event_name,
    (SELECT
            min(partition_checkpoint)
        FROM
            (SELECT
                _topic,
                _partition,
                max(max_observed_timestamp) AS partition_checkpoint
            FROM
                logs_kafka_metrics
            GROUP BY
                _topic,
                _partition)) AS live_logs_checkpoint
FROM
    logs
WHERE
    and(and(greaterOrEquals(toStartOfDay(time_bucket), toStartOfDay(assumeNotNull(toDateTime('2025-12-09 00:00:00')))), lessOrEquals(toStartOfDay(time_bucket), toStartOfDay(assumeNotNull(toDateTime('2025-12-10 00:00:00'))))), 1, greaterOrEquals(timestamp, toDateTime('2026-09-23 12:03:14.285493')), indexHint(like(lower(body), '%timeout%')), ilike(toString(body), '%timeout%'), in(severity_text, tuple('warn', 'error', 'fatal')))
ORDER BY
    timestamp DESC,
    uuid DESC
LIMIT 101
OFFSET 0