posthog/query-examples
skills/query-examples/SKILL.md
HogQL query examples and reference material for PostHog data. Read when writing SQL queries to find patterns for analytics (trends, funnels, retention, lifecycle, paths, stickiness, web analytics, error tracking, logs, sessions, LLM traces) and system data (insights, dashboards, cohorts, feature flags, experiments, surveys, hog flows, data warehouse). Includes HogQL syntax differences, system model schemas, and available functions.
$ install --global
skillsauthnpx skillsauth add posthog/ai-plugin query-examplesInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 24, 2026, 8:34 PM0.5s1 file scanned
SKILL.md
- name:
- query-examples
- description:
- HogQL query examples and reference material for PostHog data. Read when writing SQL queries to find patterns for analytics (trends, funnels, retention, lifecycle, paths, stickiness, web analytics, error tracking, logs, sessions, LLM traces) and system data (insights, dashboards, cohorts, feature flags, experiments, surveys, hog flows, data warehouse). Includes HogQL syntax differences, system model schemas, and available functions.
Querying data in PostHog
If the MCP server haven't provided instructions on querying data in PostHog, read the guidelines.
Data Schema
Schema reference for PostHog's core system models, organized by domain:
- Activity logs
- Actions
- Alerts
- Annotations
- Batch exports
- Early Access Features
- Cohorts & Persons
- Dashboards, Tiles & Insights
- Data Warehouse
- Data Modeling Endpoints
- Error Tracking
- Flags & Experiments
- Hog Flows
- Hog Functions
- Integrations
- Logs
- Notebooks
- Session Recording Playlists
- Session Recordings
- Support Tickets
- Surveys
- SQL Variables
- Skipped events in the read-data-schema tool
- Dynamic person and event properties — patterns like
$survey_dismissed/{id},$feature/{key}that don't appear in tool results
HogQL References
- Person property modes (event-time vs query-time). Read when working with
person.properties.*to understand if values are historical or current. - Sparkline, SemVer, Session replays, Actions, Translation, HTML tags and links, Text effects, and more
- SQL variables.
- Available functions in HogQL. IMPORTANT: the list is long, so read data using bash commands like grep.
Analytics Query Examples
Use the examples below to create optimized analytical queries.
- Trends (unique users, specific time range, single series)
- Trends (total count with multiple breakdowns)
- Funnel (two steps, aggregated by unique users, broken down by the person's role, sequential, 14-day conversion window)
- Conversion trends (funnel, two steps, aggregated by unique groups, 1-day conversion window)
- Retention (unique users, returned to perform an event in the next 12 weeks, recurring)
- User paths (pageviews, three steps, applied path cleaning and filters, maximum 50 paths)
- Lifecycle (unique users by pageviews)
- Stickiness (counted by pageviews from unique users, defined by at least one event for the interval, non-cumulative)
- LLM trace (generations, spans, embeddings, human feedback, captured AI metrics)
- LLM traces list (searching and listing traces with property filters, two-phase query)
- Web path stats (paths, visitors, views, bounce rate)
- Web traffic channels (direct, organic search, etc)
- Web views by devices
- Web overview
- Error tracking (search for a value in an error and filtering by custom properties)
- Logs (filtering by severity and searching for a term)
- Sessions (listing sessions with duration, pageviews, and bounce rate)
- Session replay (listing recordings with activity filters)
- Team taxonomy (top events by count, paginated)
- Event taxonomy (properties of an event, with sample values)
- Person property taxonomy (sample values for person properties)
Related Skills
posthog/signals-scout-surveys
testing
VerifiedTrustedCommunity
Focused Signals scout for PostHog projects running surveys. Watches active surveys for score regressions (NPS / CSAT / rating drops), response-volume drops, abandonment spikes, and targeting drift, AND aggregates open-text responses into recurring themes the team should know about (clusters of complaints, praise, feature requests). Emits findings only when a theme or anomaly clears the confidence bar; otherwise writes durable memory and closes out empty. Self-contained peer in the signals-scout-* fleet — no dependencies on other skills. Picked uniformly at random by the coordinator alongside `signals-scout-general` and other specialists.
49SKILL.mdUpdated Jun 5, 2026
posthog/signals-scout-revenue-analytics
development
VerifiedTrustedCommunity
Focused Signals scout for PostHog projects using revenue analytics. Watches the derived revenue product for upstream failures (Stripe sync stalls, capture regressions), config drift (missing subscription property, currency mix surprises, broken Stripe↔person joins, deferred-revenue gaps), and goal-miss escalations. Emits findings only when they clear the confidence bar; otherwise writes durable memory and closes out empty. Self-contained peer in the signals-scout-* fleet — no dependencies on other skills. Picked uniformly at random by the coordinator alongside `signals-scout-general` and other specialists.
49SKILL.mdUpdated Jun 5, 2026
posthog/signals-scout-observability-gaps
testing
VerifiedTrustedCommunity
Focused Signals scout for finding observability gaps in PostHog itself — significant event volumes the team isn't tracking, custom events with no insight or dashboard coverage, insights pointing at events that have stopped firing, dashboards missing related context, critical events with no alerts. Watches the event-stream-vs-saved- inventory delta as the team's product evolves and emits findings recommending new insights, dashboard additions, or alerts when gaps clear the confidence bar. Self-contained peer in the signals-scout-* fleet — picked uniformly at random by the coordinator alongside `signals-scout-general` and other specialists.
49SKILL.mdUpdated Jun 5, 2026
posthog/signals-scout-logs
testing
VerifiedTrustedCommunity
Focused Signals scout for PostHog projects using logs. Watches for volume bursts, severity-distribution shifts, service silence, fresh message patterns, and trace-correlated bursts via the logs ingestion pipeline. Emits findings only when they clear the confidence bar; otherwise writes durable memory and closes out empty. Self-contained peer in the signals-scout-* fleet — no dependencies on other skills. Picked uniformly at random by the coordinator alongside `signals-scout-general` and other specialists.
49SKILL.mdUpdated Jun 5, 2026