Skip to main content
Version: v4.18


Retrieves diagnostic events from a Tenzir node.


diagnostics [--live] [--retro]


The diagnostics operator retrieves diagnostic events from a Tenzir node.


Work on all diagnostic events as they are generated in real-time instead of on diagnostic events persisted at a Tenzir node.


Work on persisted diagnostic events (first), even when --live is given.

See export operator for more details.


Tenzir emits diagnostic information with the following schema:


Contains detailed information about the diagnostic.

pipeline_idstringThe ID of the pipeline that created the diagnostic.
runuint64The number of the run, starting at 1 for the first run.
timestamptimeThe exact timestamp of the diagnostic creation.
messagestringThe diagnostic message.
severitystringThe diagnostic severity.
noteslist<record>The diagnostic notes. Can be empty.
annotationslist<record>The diagnostic annotations. Can be empty.
renderedstringThe rendered diagnostic, as printed on the command-line.

The record notes has the following schema:

kindstringThe kind of note, which is note, usage, hint or docs.
messagestringThe message of this note.

The record annotations has the following schema:

primaryboolTrue if the source represents the underlying reason for the diagnostic, false if it is only related to it.
textstringA message for explanations. Can be empty.
sourcestringThe character range in the pipeline string that this annotation is associated to.


View all diagnostics generated in the past five minutes.

| where timestamp > 5 minutes ago

Only show diagnostics that contain the error severity.

| where severity == "error"