posthog/query-examples
skills/query-examples/SKILL.md
HogQL query examples and reference material for PostHog data. Read when writing SQL queries to find patterns for analytics (trends, funnels, retention, lifecycle, paths, stickiness, web analytics, error tracking, logs, sessions, LLM traces) and system data (insights, dashboards, cohorts, feature flags, experiments, surveys, hog flows, data warehouse). Includes HogQL syntax differences, system model schemas, and available functions.
$ install --global
skillsauthnpx skillsauth add posthog/ai-plugin query-examplesInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 24, 2026, 8:34 PM0.5s1 file scanned
SKILL.md
- name:
- query-examples
- description:
- HogQL query examples and reference material for PostHog data. Read when writing SQL queries to find patterns for analytics (trends, funnels, retention, lifecycle, paths, stickiness, web analytics, error tracking, logs, sessions, LLM traces) and system data (insights, dashboards, cohorts, feature flags, experiments, surveys, hog flows, data warehouse). Includes HogQL syntax differences, system model schemas, and available functions.
Querying data in PostHog
If the MCP server haven't provided instructions on querying data in PostHog, read the guidelines.
Data Schema
Schema reference for PostHog's core system models, organized by domain:
- Activity logs
- Actions
- Alerts
- Annotations
- Batch exports
- Early Access Features
- Cohorts & Persons
- Dashboards, Tiles & Insights
- Data Warehouse
- Data Modeling Endpoints
- Error Tracking
- Flags & Experiments
- Hog Flows
- Hog Functions
- Integrations
- Logs
- Notebooks
- Session Recording Playlists
- Session Recordings
- Support Tickets
- Surveys
- SQL Variables
- Skipped events in the read-data-schema tool
- Dynamic person and event properties — patterns like
$survey_dismissed/{id},$feature/{key}that don't appear in tool results
HogQL References
- Person property modes (event-time vs query-time). Read when working with
person.properties.*to understand if values are historical or current. - Sparkline, SemVer, Session replays, Actions, Translation, HTML tags and links, Text effects, and more
- SQL variables.
- Available functions in HogQL. IMPORTANT: the list is long, so read data using bash commands like grep.
Analytics Query Examples
Use the examples below to create optimized analytical queries.
- Trends (unique users, specific time range, single series)
- Trends (total count with multiple breakdowns)
- Funnel (two steps, aggregated by unique users, broken down by the person's role, sequential, 14-day conversion window)
- Conversion trends (funnel, two steps, aggregated by unique groups, 1-day conversion window)
- Retention (unique users, returned to perform an event in the next 12 weeks, recurring)
- User paths (pageviews, three steps, applied path cleaning and filters, maximum 50 paths)
- Lifecycle (unique users by pageviews)
- Stickiness (counted by pageviews from unique users, defined by at least one event for the interval, non-cumulative)
- LLM trace (generations, spans, embeddings, human feedback, captured AI metrics)
- LLM traces list (searching and listing traces with property filters, two-phase query)
- Web path stats (paths, visitors, views, bounce rate)
- Web traffic channels (direct, organic search, etc)
- Web views by devices
- Web overview
- Error tracking (search for a value in an error and filtering by custom properties)
- Logs (filtering by severity and searching for a term)
- Sessions (listing sessions with duration, pageviews, and bounce rate)
- Session replay (listing recordings with activity filters)
- Team taxonomy (top events by count, paginated)
- Event taxonomy (properties of an event, with sample values)
- Person property taxonomy (sample values for person properties)
Related Skills
posthog/signals-scout-tasks
data-ai
VerifiedTrustedCommunity
Signals scout for PostHog Tasks, the agent work items a project runs. Two lenses: delivery health (runs failing, clustered by repository and error class, and retry storms) every run, and on a slower rotation demand (recurring asks across human-authored tasks that point at a product gap). Skips the scout fleet's own run rows.
65SKILL.mdUpdated Jul 29, 2026
posthog/signals-scout-conversations
devops
VerifiedTrustedCommunity
Signals scout for the PostHog Conversations (support inbox) product. Watches the `$conversation_*` ticket-lifecycle events for support-delivery regressions — SLA breach-rate steps, first-response latency blowouts, backlog inflow-vs-resolution imbalance, and channel / assignment concentration — and files each dated regression as a report. Complements the per-ticket product-feedback signals the emission pipeline already fires; does not re-surface individual ticket content.
65SKILL.mdUpdated Jul 29, 2026
posthog/setting-up-data-catalog
development
VerifiedTrustedCommunity
Populates and maintains a project's data catalog (semantic layer): canonical metrics, trust marks (certifications) on warehouse tables/views, and reviewed table relationships. Use when asked to set up / seed / bootstrap the data catalog or semantic layer, to catalog a project's metrics, to certify or deprecate data sources, to propose or review table joins, or to work through the proposal review queue. To *use* an existing catalog to answer a business-number question, see querying-posthog-data instead. Trigger terms: data catalog, semantic layer, canonical metric, certify table, deprecate source, relationship proposal, metric drift, review queue.
65SKILL.mdUpdated Jul 29, 2026
posthog/investigating-logs
tools
VerifiedTrustedCommunity
Investigate logs in a PostHog project: verify a service or deployment is healthy, explain an error spike, triage an incident, or understand what a log stream is saying. Use when the user asks to "check the logs", asks whether a service, deploy, release, or change is working or broke anything, asks why errors are up or what changed, or wants the root cause of failures visible in logs. Routes the logs MCP tools (services overview, pattern mining, before/after pattern diffing, bucketed counts, facets, raw rows) so investigations start from summaries instead of raw rows or hand-written SQL over the logs table.
65SKILL.mdUpdated Jul 29, 2026