Monitoring the ingestion pipeline with Grafana MCP

The ingestion pipeline (nodejs/) is PostHog's Node.js event processing layer. It consumes events from Kafka (produced by the capture service), runs them through processing steps (person resolution, group assignment, property overrides, etc.), and produces enriched events to ClickHouse-bound Kafka topics.

A single codebase is deployed as many K8s Deployments via the posthog-app Helm chart (golden-chart migration). Each deployment sets PLUGINSERVERMODE and is distinguished in metrics by two default Prometheus labels:

• ingestion_pipeline — values: analytics, heatmaps, clientwarnings, errortracking
• ingestion_lane — values: main, overflow, historical, async, turbo

The app label (set by K8s pod labels) matches the deployment name and is the most universal scope filter across all telemetry domains.

This skill teaches how to discover live metrics using the Grafana MCP tools rather than memorizing metric names that change as the code evolves.

Environment context

The Grafana MCP is connected to a single Grafana instance scoped to one environment. If the user hasn't specified, ask which environment they want to investigate:

• prod-us — US production (us-east-1)
• prod-eu — EU production (eu-central-1)

Most ingestion app metrics are environment-specific by virtue of which Grafana you're connected to — they don't carry an environment label. CloudWatch metrics are also scoped to the connected Grafana's AWS account.

Cross-environment comparison requires switching Grafana instances (not possible in one session).

All datasource UIDs, dashboard UIDs, ingestionpipeline/ingestionlane label values, and ClickHouse type label values are identical across prod-us and prod-eu.

Key differences:

• ingestion-analytics-turbo deployment exists only in prod-us.
• Both envs use a dedicated ingestion MSK cluster separate from the events cluster —

consumers point at msk-ingestion not events (prod-us: c21; prod-eu: posthog-prod-eu-ingestion-2026-05-04).

• CloudWatch cluster IDs differ by region suffix (see topology sections below).

Observability landscape

Six telemetry domains, all validated identical across prod-us and prod-eu:

Datasource notes:

• Do NOT use primary Loki (P8E80F9AEF21F6940) — it returns 502 intermittently in both envs. Always use Loki-logs (P44D702D3E93867EC).
• Do NOT use CloudWatch Root (PAAE47F430CFD1449) — it exists only in prod-us.

Stable waypoints

These facts change infrequently and are hard to discover dynamically.

Deployment roles

All PLUGINSERVERMODE=ingestion-v2 deployments (the "analytics ingestion" family), plus specialized modes. Each golden-chart deployment runs in its own namespace matching the deployment name.

Notes:

• ingestion-analytics-turbo exists only in prod-us.
• Topic partition counts differ by env (e.g., main is 1024 in US, 512 in EU).
• Each deployment also has a DLQ topic (ingestion-analytics-main-dlq, etc.).
• KEDA autoscaling queries reference both old and new consumer group names during migration

(e.g., groupId=~"ingestion-events|ingestion-analytics-main").

Metric prefixes

Every prefix here can be discovered live with listprometheusmetric_names using datasourceUid: "victoriametrics" and regex: "<prefix>.*".

Redis topology

Ingestion workers depend on up to five Redis instances. Redis health is inferred from ingestion-side metrics and CloudWatch ElastiCache metrics.

Ingestion-side Redis metrics: overflowredirectredis*, cookielessredis_error. Infrastructure-side: CloudWatch datasource P034F075C744B399F.

prod-eu uses the same logical cluster names but different endpoint suffixes. The prod-eu primary Redis is posthog-prod-redis-encripted (sic — the typo is in the actual cluster name). The event restrictions Redis (ingestion-prod-redis) is a separate writable cluster from the primary — capture-analytics and ingestion workers both use it via EVENTRESTRICTIONSREDIS_URL.

Kafka topology

Ingestion workers interact with three Kafka systems via separate producer/consumer configs:

1. MSK ingestion cluster (consume side) — KAFKACONSUMERMETADATABROKERLIST.

Capture produces here; ingestion workers consume. Carries all ingestion-analytics-, ingestion-errortracking-, ingestion-heatmaps-, ingestion-clientwarnings- topics. Both envs have a dedicated cluster (prod-us: c21, 12 brokers; prod-eu: posthog-prod-eu-ingestion-2026-05-04). KMinion: kminion-msk-ingestion.

1. WarpStream ingestion VC (output side) — KAFKAWARPSTREAMPRODUCERMETADATABROKER_LIST.

Ingestion workers produce ALL ClickHouse-bound output here (clickhouseeventsjson, clickhouseperson, clickhousegroups, clickhouseheatmapevents, clickhouseaievents_json, etc.). In-cluster WarpStream agents (warpstream-ingestion-v2) with multi-AZ pools; plaintext, no TLS. KMinion: kminion-warpstream-ingestion.

1. MSK ingestion cluster (feedback/DLQ producer) — same physical cluster as item 1,

different producer config via KAFKAINGESTIONPRODUCERMETADATABROKER_LIST. Used for overflow/DLQ/async topics that route events BACK to the ingestion system.

• MSK (events/analytics) — the original events cluster. Still carries some legacy topics and

ClickHouse consumer groups during migration. prod-us: posthog-prod-us-events-2026-03-08 (12 brokers, kafka.m7g.8xlarge); prod-eu: posthog-prod-eu-events-2025-10-16 (15 brokers). KMinion: kminion-msk-analytics.

WarpStream virtual clusters — each VC is a separate logical cluster backed by S3, with its own agent pool, KMinion instance, and topic namespace:

WarpStream agent metrics: warpstreamagent* prefix (~10 metrics). Key: controlplaneoperationcounter (by operation), filecacheclientfetchlocalorremotecounter (cache hit/miss). Labels: virtualclusterid, agent_group (default, general, multi-az). Dashboards: warpstream (Agent Overview), dbfj5c31spa1ogf (MSK vs WarpStream — Active Produce Topics). US-only personal dashboards (not synced to EU): 8e93b023-… (CH Consumer Lag), ws-coarse-lag-explore (Coarse Lag exploration).

Postgres topology

Postgres metrics via prometheus-postgres-exporter and prometheus-postgres-persons-exporter.

prod-eu: posthog-cloud-prod-eu-central-1 and posthog-cloud-persons-prod-eu-central-1.

ClickHouse topology

ClickHouse is the ultimate downstream consumer of events the ingestion pipeline produces. Ingestion workers never talk to CH directly — they publish to Kafka topics which CH consumes via its built-in Kafka engine and Kafka Connect (DuckLake). CH health directly impacts perceived ingestion quality: if CH falls behind on consumption, users see stale data.

Cluster roles (discovered via type label on ClickHouseMetrics_*):

Most type label values are identical across prod-us and prod-eu. Minor differences like batch-exports or test may exist only in one env.

Two consumption paths from Kafka to ClickHouse:

ClickHouse now reads primarily from the WarpStream ingestion VC (where ingestion workers produce their output), not directly from MSK.

1. ClickHouse Kafka Engine — native CH feature. Metrics prefixed ClickHouseProfileEvents_Kafka*

(e.g., KafkaMessagesPolled, KafkaRowsRead, KafkaRowsRejected, KafkaCommitFailures). Consumer groups: clickhouseeventsjson (prod-us), group1 / group1_recent (prod-eu). These groups exist on BOTH MSK analytics and WarpStream ingestion — use the correct KMinion instance to distinguish: kminion-warpstream-ingestion for WarpStream, kminion-msk-analytics for MSK.

1. Kafka Connect — runs in kafka-connect namespace, uses DuckLake sink connector.

Metrics prefixed kafkaconnect and kafkaconnectducklakesinktaskmetrics. Consumer groups: connect-events-ducklake*.

Key health signals for ingestion operators:

• kminionkafkaconsumergrouptopiclag{appkubernetesioinstance="kminion-warpstream-ingestion", groupid=~"clickhouseeventsjson|group1|group1recent", topicname="clickhouseevents_json"} — lag between ingestion output and CH consumption on the WarpStream path (the primary path)
• kminionkafkaconsumergrouptopiclagseconds with same group filter — same in seconds
• ClickHouseProfileEvents_KafkaRowsRejected — rows CH couldn't parse/insert
• ClickHouseProfileEvents_FailedInsertQuery — insert failures (schema issues, too many parts, etc.)
• ClickHouseAsyncMetrics_MaxPartCountForPartition — rising part count = merge pressure
• ClickHouseMetrics_ReadonlyReplica — replicas that fell behind and went read-only
• ClickHouseAsyncMetrics_ReplicasMaxAbsoluteDelay — max replication delay
• posthogceleryclickhousetablepartscount / tablerowcount — Django-side CH health monitors

Pyroscope services

Both old (ingestion/{name}) and new ({namespace}/{name}) formats coexist in Pyroscope during the golden-chart migration. Prefer the new {namespace}/{name} format.

Profile types: processcpu:cpu:nanoseconds:cpu:nanoseconds, wall:wall:nanoseconds:wall:nanoseconds, memory:inusespace:bytes:inusespace:bytes, memory:inuseobjects:count:inuse_space:bytes.

Grafana dashboards

Discovery workflows

Prometheus / VictoriaMetrics

1. listprometheusmetricnames — datasourceUid: "victoriametrics", regex: "ingestion.*" to enumerate app metrics
2. Pick a metric, then listprometheuslabel_names scoped to it — see available dimensions
3. listprometheuslabel_values — discover actual values for a label

(e.g. labelName: "cause" on ingestioneventdropped_total)

1. queryprometheus with PromQL — always scope by app or ingestionpipeline and set a time range

Repeat with other prefixes: consumedbatch, person, personhog, overflowredirect, ClickHouseMetrics, kafkaconnect_, etc.

Loki (logs)

1. listlokilabel_names — datasourceUid: "P44D702D3E93867EC"
2. listlokilabel_values for app — find ingestion containers (values like ingestion-analytics-main, logs-ingestion, etc.)
3. querylokilogs — e.g. {app=~"ingestion-.*"} |= "error" or {namespace="clickhouse"} |= "Exception"

Pyroscope (profiling)

1. listpyroscopeprofiletypes — datasource_uid: "pyroscope"
2. fetchpyroscopeprofile — matchers: '{service_name="ingestion-analytics-main/ingestion-analytics-main"}',

profiletype: "processcpu:cpu:nanoseconds:cpu:nanoseconds"

Dashboards

1. search_dashboards — query "ingestion" or "clickhouse" or a specific deployment name
2. getdashboardby_uid — use a known UID (e.g. "ingestion-health") to get panel details
3. getdashboardpanel_queries — extract PromQL from existing panels

Redis / ElastiCache

• Ingestion-side: discover overflowredirectredis, cookielessredis_ metrics in VictoriaMetrics
• Infrastructure: CloudWatch datasource P034F075C744B399F for ElastiCache

(CPU, memory, connections, latency). Cluster IDs: ingestion-prod-redis, posthog-solo (prod-us primary), ingestion-duplicates-prod-redis, cookieless-prod-redis

Postgres / Aurora

• Ingestion-side: discover postgreserrortotal, person, group metrics
• Infrastructure: prometheus-postgres-exporter and prometheus-postgres-persons-exporter metrics
• CloudWatch RDS: datasource P034F075C744B399F with cluster IDs

posthog-cloud-prod-us-east-1 / posthog-cloud-persons-prod-us-east-1

ClickHouse

• Cluster health: listprometheusmetricnames with regex "ClickHouseMetrics." or "ClickHouseProfileEvents_."

Scope with type label for cluster role (e.g. type="events")

• Kafka engine health: regex "ClickHouseProfileEvents_Kafka.*"
• Kafka Connect: regex "kafkaconnect.*" — scope with namespace="kafka-connect"
• Consumer lag (the bridge): kminionkafkaconsumergrouptopic_lag with

groupid=~"clickhouseeventsjson|group1|group1recent|connect-events-ducklake.*" and topicname="clickhouseeventsjson". Important: scope with appkubernetesioinstance="kminion-warpstream-ingestion" for the WarpStream path (primary) or "kminion-msk-analytics" for the MSK path.

• Logs: {namespace="clickhouse"} |= "Exception" or {namespace="kafka-connect"}
• Dashboards: vm-clickhouse-cluster-overview, clickhouse-ingestion-overview-20260615,

cdzv7o1635n9ca, 8e93b023-a544-4a3b-8fac-123459d4eb84 (WarpStream CH consumer lag)

Key metric domains

Categories of what to look for. Discover specific metrics live using the prefixes above.

Kafka consumer health — batch duration, messages consumed per batch, consumer group assignment/rebalance events, consumer lag (via KMinion). Metrics: consumedbatch, kafkaconsumer, kminionkafkaconsumergrouptopiclag* scoped by groupid.

Pipeline processing — step-level latency and error rates, pipeline result distribution (ingested, filtered, dropped, DLQ'd). Metrics: eventspipelinestepms, eventspipelinesteperrortotal, ingestionpipeline_results by result.

Person/group stores — person flush latency, cache hit rates, Postgres write latency, merge failures, properties size. Metrics: person, group, personhog_*.

Outputs — Kafka production to ClickHouse-bound topics. Message size, latency, errors. Metrics: ingestionoutputs* by topic.

Overflow routing — stateful overflow decisions, Redis operations for overflow state. Metrics: overflowredirect* by type, result, decision.

ClickHouse downstream health — CH cluster QPS, memory, disk, merge pressure, replication lag, Kafka engine consumption (rows read/rejected/failed), Kafka Connect task health and consumer lag. This tells you whether events are actually making it to the query layer. Metrics: ClickHouseMetrics, ClickHouseProfileEvents, ClickHouseAsyncMetrics scoped by type; kafkaconnect_ scoped by namespace.

K8s resources — container and kube for CPU, memory, restarts, HPA state. Scope: namespace=~"ingestion-.", pod=~"ingestion-." (or namespace="clickhouse", pod=~"chi-ingestion-.*" for CH ingestion pods).

Investigation playbooks

See [references/investigation-playbooks.md](./references/investigation-playbooks.md) for step-by-step workflows covering: health checks, event drops, latency, consumer lag, person processing (including the pganalyze query-level view of the persons DB), Kafka/MSK issues, Redis, Postgres, session replay, ClickHouse downstream health, single-partition lag (keyed-cost diagnosis, handing off to the querying-tophog skill for actor identification), and cross-environment comparison.