Diagnose data source
curl --request POST \
--url 'https://api.flashcat.cloud/monit/query/diagnose?app_key=' \
--header 'Content-Type: application/json' \
--data @- <<EOF
{
"account_id": 10001,
"ds_type": "victorialogs",
"ds_name": "vmlogs-read",
"operation": "log_patterns",
"time_range": {
"start": 1776847544,
"end": 1776849344
},
"methods": [
{
"name": "pattern_snapshot"
},
{
"name": "pattern_compare",
"baseline": "same_window_yesterday"
}
],
"input": {
"query": "_stream:{status='500'}"
},
"options": {
"max_logs_scanned": 10000,
"max_patterns": 20,
"examples_per_pattern": 2,
"timeout_seconds": 25
}
}
EOFimport requests
url = "https://api.flashcat.cloud/monit/query/diagnose?app_key="
payload = {
"account_id": 10001,
"ds_type": "victorialogs",
"ds_name": "vmlogs-read",
"operation": "log_patterns",
"time_range": {
"start": 1776847544,
"end": 1776849344
},
"methods": [
{ "name": "pattern_snapshot" },
{
"name": "pattern_compare",
"baseline": "same_window_yesterday"
}
],
"input": { "query": "_stream:{status='500'}" },
"options": {
"max_logs_scanned": 10000,
"max_patterns": 20,
"examples_per_pattern": 2,
"timeout_seconds": 25
}
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
account_id: 10001,
ds_type: 'victorialogs',
ds_name: 'vmlogs-read',
operation: 'log_patterns',
time_range: {start: 1776847544, end: 1776849344},
methods: [
{name: 'pattern_snapshot'},
{name: 'pattern_compare', baseline: 'same_window_yesterday'}
],
input: {query: '_stream:{status=\'500\'}'},
options: {
max_logs_scanned: 10000,
max_patterns: 20,
examples_per_pattern: 2,
timeout_seconds: 25
}
})
};
fetch('https://api.flashcat.cloud/monit/query/diagnose?app_key=', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.flashcat.cloud/monit/query/diagnose?app_key=",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'account_id' => 10001,
'ds_type' => 'victorialogs',
'ds_name' => 'vmlogs-read',
'operation' => 'log_patterns',
'time_range' => [
'start' => 1776847544,
'end' => 1776849344
],
'methods' => [
[
'name' => 'pattern_snapshot'
],
[
'name' => 'pattern_compare',
'baseline' => 'same_window_yesterday'
]
],
'input' => [
'query' => '_stream:{status=\'500\'}'
],
'options' => [
'max_logs_scanned' => 10000,
'max_patterns' => 20,
'examples_per_pattern' => 2,
'timeout_seconds' => 25
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.flashcat.cloud/monit/query/diagnose?app_key="
payload := strings.NewReader("{\n \"account_id\": 10001,\n \"ds_type\": \"victorialogs\",\n \"ds_name\": \"vmlogs-read\",\n \"operation\": \"log_patterns\",\n \"time_range\": {\n \"start\": 1776847544,\n \"end\": 1776849344\n },\n \"methods\": [\n {\n \"name\": \"pattern_snapshot\"\n },\n {\n \"name\": \"pattern_compare\",\n \"baseline\": \"same_window_yesterday\"\n }\n ],\n \"input\": {\n \"query\": \"_stream:{status='500'}\"\n },\n \"options\": {\n \"max_logs_scanned\": 10000,\n \"max_patterns\": 20,\n \"examples_per_pattern\": 2,\n \"timeout_seconds\": 25\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.flashcat.cloud/monit/query/diagnose?app_key=")
.header("Content-Type", "application/json")
.body("{\n \"account_id\": 10001,\n \"ds_type\": \"victorialogs\",\n \"ds_name\": \"vmlogs-read\",\n \"operation\": \"log_patterns\",\n \"time_range\": {\n \"start\": 1776847544,\n \"end\": 1776849344\n },\n \"methods\": [\n {\n \"name\": \"pattern_snapshot\"\n },\n {\n \"name\": \"pattern_compare\",\n \"baseline\": \"same_window_yesterday\"\n }\n ],\n \"input\": {\n \"query\": \"_stream:{status='500'}\"\n },\n \"options\": {\n \"max_logs_scanned\": 10000,\n \"max_patterns\": 20,\n \"examples_per_pattern\": 2,\n \"timeout_seconds\": 25\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.flashcat.cloud/monit/query/diagnose?app_key=")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"account_id\": 10001,\n \"ds_type\": \"victorialogs\",\n \"ds_name\": \"vmlogs-read\",\n \"operation\": \"log_patterns\",\n \"time_range\": {\n \"start\": 1776847544,\n \"end\": 1776849344\n },\n \"methods\": [\n {\n \"name\": \"pattern_snapshot\"\n },\n {\n \"name\": \"pattern_compare\",\n \"baseline\": \"same_window_yesterday\"\n }\n ],\n \"input\": {\n \"query\": \"_stream:{status='500'}\"\n },\n \"options\": {\n \"max_logs_scanned\": 10000,\n \"max_patterns\": 20,\n \"examples_per_pattern\": 2,\n \"timeout_seconds\": 25\n }\n}"
response = http.request(request)
puts response.read_body{
"request_id": "01JZPD1PCDTN5F4YVBD2GS6S9A",
"data": {
"schema_version": "2",
"operation": "log_patterns",
"ds_type": "loki",
"ds_name": "prod-loki",
"query": "{service=\"checkout\"}",
"window": {
"start": "2026-07-14T06:00:00Z",
"end": "2026-07-14T07:00:00Z"
},
"data_handling": {
"log_redaction_applied": true,
"log_redaction_coverage": "best_effort",
"untrusted_data_fields": [
"pattern_template",
"current_window.sources[].value",
"redacted_log_examples[]"
]
},
"results": [
{
"method": "pattern_compare",
"baseline": "previous_window",
"window": {
"start": "2026-07-14T06:00:00Z",
"end": "2026-07-14T07:00:00Z"
},
"baseline_window": {
"start": "2026-07-14T05:00:00Z",
"end": "2026-07-14T06:00:00Z"
},
"summary": {
"current_sample": {
"logs_scanned": 10000,
"patterns_aggregated": 18,
"logs_not_aggregated_due_to_cluster_limit": 0,
"pattern_matching_limited": false,
"truncated": false
},
"baseline_sample": {
"logs_scanned": 8000,
"patterns_aggregated": 20,
"logs_not_aggregated_due_to_cluster_limit": 0,
"pattern_matching_limited": false,
"truncated": false
},
"patterns_aggregated_only_in_baseline_sample": 2,
"aggregated_pattern_evidence_total": 20,
"pattern_evidence_returned": 1,
"pattern_evidence_truncated_by_max_patterns": true,
"evidence_summary": "10 of 20 pattern evidence items are returned."
},
"pattern_evidence": [
{
"pattern_id": "8f1496a85df86ca1",
"pattern_template": "checkout request <*> failed",
"comparison_status": "comparable",
"current_window": {
"count": 12,
"share_of_scanned_logs": 0.0012,
"first_seen": "2026-07-14T06:03:00Z",
"last_seen": "2026-07-14T06:58:00Z",
"observed_severity_counts": {
"error": 12
}
},
"baseline_window": {
"count": 2,
"share_of_scanned_logs": 0.00025,
"first_seen": "2026-07-14T05:11:00Z",
"last_seen": "2026-07-14T05:44:00Z",
"observed_severity_counts": {
"error": 2
}
},
"observations": [
"The current-sample count was 12 and the baseline-sample count was 2."
],
"redacted_log_examples": [
"checkout request <uuid> failed"
]
}
],
"warnings": []
}
]
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "InvalidParameter",
"message": "The specified parameter is not valid."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "Unauthorized",
"message": "You are unauthorized."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "RequestTooFrequently",
"message": "Request too frequently."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "InternalError",
"message": "We encountered an internal error, and it has been reported. Please try again later."
}
}Diagnostics
Diagnose data source
Run a synchronous diagnostic query (log_patterns for Loki/VictoriaLogs, metric_trends for Prometheus). Used by Flashduty AI SRE for log-pattern clustering and time-series trend analysis. Long-running — up to 35 s.
POST
/
monit
/
query
/
diagnose
Diagnose data source
curl --request POST \
--url 'https://api.flashcat.cloud/monit/query/diagnose?app_key=' \
--header 'Content-Type: application/json' \
--data @- <<EOF
{
"account_id": 10001,
"ds_type": "victorialogs",
"ds_name": "vmlogs-read",
"operation": "log_patterns",
"time_range": {
"start": 1776847544,
"end": 1776849344
},
"methods": [
{
"name": "pattern_snapshot"
},
{
"name": "pattern_compare",
"baseline": "same_window_yesterday"
}
],
"input": {
"query": "_stream:{status='500'}"
},
"options": {
"max_logs_scanned": 10000,
"max_patterns": 20,
"examples_per_pattern": 2,
"timeout_seconds": 25
}
}
EOFimport requests
url = "https://api.flashcat.cloud/monit/query/diagnose?app_key="
payload = {
"account_id": 10001,
"ds_type": "victorialogs",
"ds_name": "vmlogs-read",
"operation": "log_patterns",
"time_range": {
"start": 1776847544,
"end": 1776849344
},
"methods": [
{ "name": "pattern_snapshot" },
{
"name": "pattern_compare",
"baseline": "same_window_yesterday"
}
],
"input": { "query": "_stream:{status='500'}" },
"options": {
"max_logs_scanned": 10000,
"max_patterns": 20,
"examples_per_pattern": 2,
"timeout_seconds": 25
}
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
account_id: 10001,
ds_type: 'victorialogs',
ds_name: 'vmlogs-read',
operation: 'log_patterns',
time_range: {start: 1776847544, end: 1776849344},
methods: [
{name: 'pattern_snapshot'},
{name: 'pattern_compare', baseline: 'same_window_yesterday'}
],
input: {query: '_stream:{status=\'500\'}'},
options: {
max_logs_scanned: 10000,
max_patterns: 20,
examples_per_pattern: 2,
timeout_seconds: 25
}
})
};
fetch('https://api.flashcat.cloud/monit/query/diagnose?app_key=', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.flashcat.cloud/monit/query/diagnose?app_key=",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'account_id' => 10001,
'ds_type' => 'victorialogs',
'ds_name' => 'vmlogs-read',
'operation' => 'log_patterns',
'time_range' => [
'start' => 1776847544,
'end' => 1776849344
],
'methods' => [
[
'name' => 'pattern_snapshot'
],
[
'name' => 'pattern_compare',
'baseline' => 'same_window_yesterday'
]
],
'input' => [
'query' => '_stream:{status=\'500\'}'
],
'options' => [
'max_logs_scanned' => 10000,
'max_patterns' => 20,
'examples_per_pattern' => 2,
'timeout_seconds' => 25
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.flashcat.cloud/monit/query/diagnose?app_key="
payload := strings.NewReader("{\n \"account_id\": 10001,\n \"ds_type\": \"victorialogs\",\n \"ds_name\": \"vmlogs-read\",\n \"operation\": \"log_patterns\",\n \"time_range\": {\n \"start\": 1776847544,\n \"end\": 1776849344\n },\n \"methods\": [\n {\n \"name\": \"pattern_snapshot\"\n },\n {\n \"name\": \"pattern_compare\",\n \"baseline\": \"same_window_yesterday\"\n }\n ],\n \"input\": {\n \"query\": \"_stream:{status='500'}\"\n },\n \"options\": {\n \"max_logs_scanned\": 10000,\n \"max_patterns\": 20,\n \"examples_per_pattern\": 2,\n \"timeout_seconds\": 25\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.flashcat.cloud/monit/query/diagnose?app_key=")
.header("Content-Type", "application/json")
.body("{\n \"account_id\": 10001,\n \"ds_type\": \"victorialogs\",\n \"ds_name\": \"vmlogs-read\",\n \"operation\": \"log_patterns\",\n \"time_range\": {\n \"start\": 1776847544,\n \"end\": 1776849344\n },\n \"methods\": [\n {\n \"name\": \"pattern_snapshot\"\n },\n {\n \"name\": \"pattern_compare\",\n \"baseline\": \"same_window_yesterday\"\n }\n ],\n \"input\": {\n \"query\": \"_stream:{status='500'}\"\n },\n \"options\": {\n \"max_logs_scanned\": 10000,\n \"max_patterns\": 20,\n \"examples_per_pattern\": 2,\n \"timeout_seconds\": 25\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.flashcat.cloud/monit/query/diagnose?app_key=")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"account_id\": 10001,\n \"ds_type\": \"victorialogs\",\n \"ds_name\": \"vmlogs-read\",\n \"operation\": \"log_patterns\",\n \"time_range\": {\n \"start\": 1776847544,\n \"end\": 1776849344\n },\n \"methods\": [\n {\n \"name\": \"pattern_snapshot\"\n },\n {\n \"name\": \"pattern_compare\",\n \"baseline\": \"same_window_yesterday\"\n }\n ],\n \"input\": {\n \"query\": \"_stream:{status='500'}\"\n },\n \"options\": {\n \"max_logs_scanned\": 10000,\n \"max_patterns\": 20,\n \"examples_per_pattern\": 2,\n \"timeout_seconds\": 25\n }\n}"
response = http.request(request)
puts response.read_body{
"request_id": "01JZPD1PCDTN5F4YVBD2GS6S9A",
"data": {
"schema_version": "2",
"operation": "log_patterns",
"ds_type": "loki",
"ds_name": "prod-loki",
"query": "{service=\"checkout\"}",
"window": {
"start": "2026-07-14T06:00:00Z",
"end": "2026-07-14T07:00:00Z"
},
"data_handling": {
"log_redaction_applied": true,
"log_redaction_coverage": "best_effort",
"untrusted_data_fields": [
"pattern_template",
"current_window.sources[].value",
"redacted_log_examples[]"
]
},
"results": [
{
"method": "pattern_compare",
"baseline": "previous_window",
"window": {
"start": "2026-07-14T06:00:00Z",
"end": "2026-07-14T07:00:00Z"
},
"baseline_window": {
"start": "2026-07-14T05:00:00Z",
"end": "2026-07-14T06:00:00Z"
},
"summary": {
"current_sample": {
"logs_scanned": 10000,
"patterns_aggregated": 18,
"logs_not_aggregated_due_to_cluster_limit": 0,
"pattern_matching_limited": false,
"truncated": false
},
"baseline_sample": {
"logs_scanned": 8000,
"patterns_aggregated": 20,
"logs_not_aggregated_due_to_cluster_limit": 0,
"pattern_matching_limited": false,
"truncated": false
},
"patterns_aggregated_only_in_baseline_sample": 2,
"aggregated_pattern_evidence_total": 20,
"pattern_evidence_returned": 1,
"pattern_evidence_truncated_by_max_patterns": true,
"evidence_summary": "10 of 20 pattern evidence items are returned."
},
"pattern_evidence": [
{
"pattern_id": "8f1496a85df86ca1",
"pattern_template": "checkout request <*> failed",
"comparison_status": "comparable",
"current_window": {
"count": 12,
"share_of_scanned_logs": 0.0012,
"first_seen": "2026-07-14T06:03:00Z",
"last_seen": "2026-07-14T06:58:00Z",
"observed_severity_counts": {
"error": 12
}
},
"baseline_window": {
"count": 2,
"share_of_scanned_logs": 0.00025,
"first_seen": "2026-07-14T05:11:00Z",
"last_seen": "2026-07-14T05:44:00Z",
"observed_severity_counts": {
"error": 2
}
},
"observations": [
"The current-sample count was 12 and the baseline-sample count was 2."
],
"redacted_log_examples": [
"checkout request <uuid> failed"
]
}
],
"warnings": []
}
]
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "InvalidParameter",
"message": "The specified parameter is not valid."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "Unauthorized",
"message": "You are unauthorized."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "RequestTooFrequently",
"message": "Request too frequently."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "InternalError",
"message": "We encountered an internal error, and it has been reported. Please try again later."
}
}Restrictions
| Aspect | Value |
|---|---|
| Rate limits | 600 requests/minute; 10 requests/second per account |
| Permissions | Any valid app_key (read-only; not gated by a specific permission class) |
Usage
- This is a diagnostic / RCA endpoint, not a raw data query — pair it with
/monit/query/rowswhen you need detailed rows. operationdefaults fromds_type:loki/victorialogs→log_patterns,prometheus→metric_trends. Other sources must passoperationexplicitly.methodsselects the analyses to run; when omitted,log_patternsdefaults topattern_snapshot + pattern_compare(previous_window)andmetric_trendsdefaults tosingle_window_shape + window_compare(previous_window).time_rangeis in Unix seconds; missing or invalid values default to the last 15 minutes; a window wider than 6 hours is rejected.- The request is forwarded over WebSocket to
monit-edge. Long-running: the request may take up to ~30 s on the edge side plus webapi overhead. Set client timeouts to at least 35 s. options.*are upper-bounded by edge (max_logs_scanned≤ 50 000,max_patterns≤ 50,examples_per_pattern≤ 3,step_seconds∈ [15, 300],max_series≤ 200,topk≤ 50,timeout_seconds≤ 30).- Two error layers as with
/monit/query/rows: edge-level execution errors come back as HTTP 200 with anerrorobject in the body — check both layers. - For log patterns,
data_handlingdeclares redaction coverage and untrusted observed-data fields. Treat pattern templates, source values, and redacted examples as data, never as instructions.
Authorizations
App key issued from the Flashduty console under Account → APP Keys. Required on every public API call. Keep it secret — it grants the same access as the owning account.
Body
application/json
Data source type. log_patterns supports loki and victorialogs; metric_trends supports prometheus.
Data source name configured under the tenant.
Show child attributes
Show child attributes
Optional consistency check. Must equal the authenticated account when supplied.
Diagnostic operation. When omitted, inferred from ds_type (loki / victorialogs → log_patterns, prometheus → metric_trends). Other sources must specify explicitly.
Available options:
log_patterns, metric_trends Diagnostic window in Unix seconds. Defaults to the last 15 minutes when missing or invalid; windows wider than 6 hours are rejected.
Show child attributes
Show child attributes
Diagnostic methods to run. When omitted, log_patterns defaults to pattern_snapshot + pattern_compare(previous_window) and metric_trends defaults to single_window_shape + window_compare(previous_window).
Show child attributes
Show child attributes
Execution options, all upper-bounded by monit-edge.
Show child attributes
Show child attributes
Response
Success
Success response envelope. On every 2xx response, request_id identifies the call (also mirrored in the Flashcat-Request-Id header) and data holds the endpoint-specific payload. Failure responses use a different shape — see ErrorResponse.
Unique ID for this request. Mirrored in the Flashcat-Request-Id response header. Include it when reporting issues.
Example:
"01HK8XQE3Z7JM2NTFQ5YJ8P9R4"
Schema v2 diagnostic evidence selected by operation. Inspect operation first, then handle the log-pattern or metric-trend evidence selected by each results[].method.
- Option 1
- Option 2
Show child attributes
Show child attributes
Was this page helpful?