Skip to main content
Version: v4.24

diagnostics

Retrieves diagnostic events from a Tenzir node.

Synopsis

diagnostics [--live] [--retro]

Description

The diagnostics operator retrieves diagnostic events from a Tenzir node.

--live

Work on all diagnostic events as they are generated in real-time instead of on diagnostic events persisted at a Tenzir node.

--retro

Work on persisted diagnostic events (first), even when --live is given.

See export operator for more details.

Schemas

Tenzir emits diagnostic information with the following schema:

tenzir.diagnostic

Contains detailed information about the diagnostic.

FieldTypeDescription
pipeline_idstringThe ID of the pipeline that created the diagnostic.
runuint64The number of the run, starting at 1 for the first run.
timestamptimeThe exact timestamp of the diagnostic creation.
messagestringThe diagnostic message.
severitystringThe diagnostic severity.
noteslist<record>The diagnostic notes. Can be empty.
annotationslist<record>The diagnostic annotations. Can be empty.
renderedstringThe rendered diagnostic, as printed on the command-line.

The record notes has the following schema:

FieldTypeDescription
kindstringThe kind of note, which is note, usage, hint or docs.
messagestringThe message of this note.

The record annotations has the following schema:

FieldTypeDescription
primaryboolTrue if the source represents the underlying reason for the diagnostic, false if it is only related to it.
textstringA message for explanations. Can be empty.
sourcestringThe character range in the pipeline string that this annotation is associated to.

Examples

View all diagnostics generated in the past five minutes.

diagnostics
| where timestamp > 5 minutes ago

Only show diagnostics that contain the error severity.

diagnostics
| where severity == "error"