Skip to main content
POST
/
monit
/
query
/
diagnose
Diagnose data source
curl --request POST \
  --url 'https://api.flashcat.cloud/monit/query/diagnose?app_key=' \
  --header 'Content-Type: application/json' \
  --data @- <<EOF
{
  "account_id": 10001,
  "ds_type": "victorialogs",
  "ds_name": "vmlogs-read",
  "operation": "log_patterns",
  "time_range": {
    "start": 1776847544,
    "end": 1776849344
  },
  "methods": [
    {
      "name": "pattern_snapshot"
    },
    {
      "name": "pattern_compare",
      "baseline": "same_window_yesterday"
    }
  ],
  "input": {
    "query": "_stream:{status='500'}"
  },
  "options": {
    "max_logs_scanned": 10000,
    "max_patterns": 20,
    "examples_per_pattern": 2,
    "timeout_seconds": 25
  }
}
EOF
{
  "request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
  "data": {
    "operation": "log_patterns",
    "ds_type": "victorialogs",
    "ds_name": "vmlogs-read",
    "query": "_stream:{status='500'}",
    "window": {
      "start": 1776847544,
      "end": 1776849344
    },
    "results": [
      {
        "method": "pattern_snapshot",
        "window": {
          "start": 1776847544,
          "end": 1776849344
        },
        "summary": {
          "logs_scanned": 405,
          "baseline_logs_scanned": 0,
          "current_truncated": false,
          "baseline_truncated": false,
          "patterns_total": 2,
          "returned_patterns": 2,
          "new_patterns": 0,
          "surging_patterns": 0,
          "surging_threshold": {
            "change_ratio_min": 3,
            "count_min": 5
          }
        },
        "patterns": [
          {
            "pattern_hash": "239fa5da",
            "template": "POST /api/v<number>/orders/<number> HTTP/<number>",
            "count": 213,
            "first_seen": 1776847562,
            "last_seen": 1776849336,
            "severity": "unknown",
            "approximate": false,
            "sources": [
              {
                "field": "pod",
                "value": "order-api-7f69d8d9b6-m4x9n",
                "count": 130
              }
            ],
            "examples": [
              "POST /api/v<number>/orders/<number> HTTP/<number>"
            ]
          }
        ],
        "warnings": [
          "examples redacted"
        ]
      }
    ]
  }
}

​
Restrictions

AspectValue
Rate limits600 requests/minute; 10 requests/second per account
PermissionsAny valid app_key (read-only; not gated by a specific permission class)

​
Usage

  • This is a diagnostic / RCA endpoint, not a raw data query — pair it with /monit/query/rows when you need detailed rows.
  • operation defaults from ds_type: loki / victorialogs → log_patterns, prometheus → metric_trends. Other sources must pass operation explicitly.
  • methods selects the analyses to run; when omitted, log_patterns defaults to pattern_snapshot + pattern_compare(previous_window) and metric_trends defaults to single_window_shape + window_compare(previous_window).
  • time_range is in Unix seconds; missing or invalid values default to the last 15 minutes; a window wider than 6 hours is rejected.
  • The request is forwarded over WebSocket to monit-edge. Long-running: the request may take up to ~30 s on the edge side plus webapi overhead. Set client timeouts to at least 35 s.
  • options.* are upper-bounded by edge (max_logs_scanned ≤ 50 000, max_patterns ≤ 50, examples_per_pattern ≤ 3, step_seconds ∈ [15, 300], max_series ≤ 200, topk ≤ 50, timeout_seconds ≤ 30).
  • Two error layers as with /monit/query/rows: edge-level execution errors come back as HTTP 200 with an error object in the body — check both layers.
  • Log examples are basic-redacted before being returned; expect warnings: ["examples redacted"]. Do not treat them as raw logs.

Authorizations

​
app_key
string
query
required

App key issued from the Flashduty console under Account → APP Keys. Required on every public API call. Keep it secret — it grants the same access as the owning account.

Body

application/json
​
ds_type
string
required

Data source type. log_patterns supports loki and victorialogs; metric_trends supports prometheus.

​
ds_name
string
required

Data source name configured under the tenant.

​
input
object
required
​
account_id
integer<int64>

Optional consistency check. Must equal the authenticated account when supplied.

​
operation
enum<string>

Diagnostic operation. When omitted, inferred from ds_type (loki / victorialogs → log_patterns, prometheus → metric_trends). Other sources must specify explicitly.

Available options:
log_patterns,
metric_trends
​
time_range
object

Diagnostic window in Unix seconds. Defaults to the last 15 minutes when missing or invalid; windows wider than 6 hours are rejected.

​
methods
object[]

Diagnostic methods to run. When omitted, log_patterns defaults to pattern_snapshot + pattern_compare(previous_window) and metric_trends defaults to single_window_shape + window_compare(previous_window).

​
options
object

Execution options, all upper-bounded by monit-edge.

Response

Success

Success response envelope. On every 2xx response, request_id identifies the call (also mirrored in the Flashcat-Request-Id header) and data holds the endpoint-specific payload. Failure responses use a different shape — see ErrorResponse.

​
request_id
string
required

Unique ID for this request. Mirrored in the Flashcat-Request-Id response header. Include it when reporting issues.

Example:

"01HK8XQE3Z7JM2NTFQ5YJ8P9R4"

​
data
object
required

Operation-specific diagnostic result. Inspect operation first, then results[]. The shape of results[].patterns (for log_patterns) vs results[].series (for metric_trends) differs by operation; the full schema is documented in the monit-webapi diagnose-api guide.