O11y

The hanzo o11y commands.

Also for this capability: API · CLI · MCP · SDKs

Your logs, metrics and traces: ship them in, query them, chart them.

API reference →

hanzo o11y roles list

Every command takes --json for the raw response and --help for its own flags. Sign in once with hanzo auth login; the commands below use that session, and the org they act in is the one it carries.

CommandWhat it does
hanzo o11y countErrorsCounts the grouped exceptions in the query window for the caller's org.
hanzo o11y dependency_graph --end <end> --start <start>Returns the service dependency graph over the requested window: every parent→child edge observed, with call and error rates and latency percentiles per edge.
hanzo o11y disksLists the storage disks the datastore reports, with their names and types.
hanzo o11y errorFromErrorID --timestamp <timestamp> --group-id <group-id>Returns one exception instance and the span it happened on, by its error id within a group at a timestamp.
hanzo o11y errorFromGroupID --timestamp <timestamp> --group-id <group-id>Returns the representative exception instance of a group at a timestamp, and the span it happened on.
hanzo o11y event --event-type <eventType>Records one product-analytics event for the signed-in user — a track event with a name and free-form attributes.
hanzo o11y export_raw_dataExport raw telemetry rows as a file
hanzo o11y featuresReturns the supported feature flags and their resolved values for the caller's org.
hanzo o11y filter_suggestions --data-source <data-source>Suggests attribute keys and example filter queries for the query builder, seeded by what the org's own telemetry carries.
hanzo o11y healthReports service health.
hanzo o11y healthzHealth of the observability runtime's services
hanzo o11y listErrorsLists the grouped exceptions in the query window — each an exception type with its message, count, service and first/last-seen — for the caller's org.
hanzo o11y livezLiveness of the observability process
hanzo o11y loginReport why an observability sign-in did not complete
hanzo o11y nextPrevErrorIDs --timestamp <timestamp> --group-id <group-id>Returns the ids of the exception instances immediately after and before a given one within its group — the paging cursor the error detail view walks.
hanzo o11y query --query <query>Evaluates one instant PromQL query against the org's metrics and returns the result at a single point in time.
hanzo o11y query_progressWatch one running query's progress
hanzo o11y readyzReadiness of the observability runtime to serve
hanzo o11y sessionsList the caller org's LLM sessions
hanzo o11y span_percentile --name <name> --service-name <serviceName>Places one span's duration among its peers: the p50/p90/p99 durations of like spans, and the percentile the given duration lands at.
hanzo o11y statsReturns the collected usage statistics for the caller's org, as the stats reporter aggregates them — a map whose keys are the reporter's own counter names.
hanzo o11y statusReports whether a product's service is live: an in-cluster health probe with its measured latency, fused with the per-replica up inventory.
hanzo o11y substitute_varsSubstitutes a query's variables and returns the resolved request, without running it — what a dashboard does before it queries.
hanzo o11y summaryReports whether the platform is up.
hanzo o11y testChannelSends a test notification to the posted receiver.
hanzo o11y testRuleFires a test notification for the posted rule definition and answers with how many series alerted and a status message.
hanzo o11y usage --start <start> --end <end>Returns ingestion usage counts bucketed over the requested window, optionally narrowed to one service.
hanzo o11y versionReports the running build: its version, whether an enterprise edition is present ("N" in this build), and whether first-user setup has completed.

Alerts

CommandWhat it does
hanzo o11y alerts add <receiver>Take an Alertmanager notification and page a human
hanzo o11y alerts lastReplay the alert records this process took
hanzo o11y alerts listReturns the org's current alerts.

Authz

CommandWhat it does
hanzo o11y authz checkEvaluates a batch of transactions — relation plus object — for the authenticated caller and answers each with its authorization verdict, in the order they were asked.

Auto complete

CommandWhat it does
hanzo o11y auto_complete attribute_valuesReads the attribute-value request from the body rather than off the query string — the spelling the newer builder uses to send its filters alongside the request.

Autocomplete

CommandWhat it does
hanzo o11y autocomplete aggregate_attributesLists the attributes usable as an aggregate target for the given telemetry and operator — what a filter builder offers after the aggregation is chosen.
hanzo o11y autocomplete attribute_keysLists the attribute keys available for filtering the given telemetry, each with its data type and whether it is a materialized column.
hanzo o11y autocomplete attribute_valuesLists the values one attribute key has taken — string, number and bool values in their own lists — for completing a filter.

Channels

CommandWhat it does
hanzo o11y channels createCreates a notification channel, answering with the stored channel.
hanzo o11y channels get <id>Returns one notification channel, by id.
hanzo o11y channels listLists the org's notification channels.
hanzo o11y channels rm <id>Removes a notification channel, by id.
hanzo o11y channels set <id>Replaces a notification channel's receiver, by id.
hanzo o11y channels testSends a test notification to the posted receiver.

Cloud integrations

CommandWhat it does
hanzo o11y cloud-integrations agent-check-in <cloud_provider>The deployed agent's check-in on its original hyphenated path, kept for backward compatibility with agents already running.

Cloud integrations

CommandWhat it does
hanzo o11y cloud_integrations accounts check_in <cloud_provider>The deployed agent's check-in — the path consistent with the account surface, reporting the agent's account and telemetry state so the connection can be tracked.
hanzo o11y cloud_integrations accounts create <cloud_provider>Connects a new cloud-integration account for the given provider from its posted config and credentials, answering with the account and the artifact the agent deploys to complete the connection.
hanzo o11y cloud_integrations accounts get <cloud_provider> <id>Returns one connected account for the given provider, by id.
hanzo o11y cloud_integrations accounts list <cloud_provider>Lists the cloud-integration accounts connected for the given provider.
hanzo o11y cloud_integrations accounts rm <cloud_provider> <id>Tears down a connected account for the given provider, by id.
hanzo o11y cloud_integrations accounts services get <cloud_provider> <id> <service_id>Returns one service and its configuration for a connected account of the given provider, by account id and service id.
hanzo o11y cloud_integrations accounts services list <cloud_provider> <id>Lists the services metadata for one connected account of the given provider, by account id.
hanzo o11y cloud_integrations accounts services set <cloud_provider> <id> <service_id>Changes a service's configuration for one connected account of the given provider, by account id and service id.
hanzo o11y cloud_integrations accounts set <cloud_provider> <id>Changes a connected account's configuration for the given provider, by id.
hanzo o11y cloud_integrations credentials <cloud_provider>Returns the credentials the connecting agent needs to establish the cloud integration, for the given cloud provider.
hanzo o11y cloud_integrations services get <cloud_provider> <service_id>Returns one service the given provider can collect from, by service id, optionally scoped to one cloud integration.
hanzo o11y cloud_integrations services list <cloud_provider>Lists the services the given provider can collect from, optionally scoped to one cloud integration.

Clusters

CommandWhat it does
hanzo o11y clusters attribute_keysLists the metric attribute keys Kubernetes clusters report, for building cluster filters.
hanzo o11y clusters attribute_valuesLists the values one cluster attribute key has taken, for building cluster filters.
hanzo o11y clusters listLists Kubernetes clusters over a time range, each with its CPU and memory usage against allocatable capacity and its attributes; filterable, groupable and paginated.

Daemonsets

CommandWhat it does
hanzo o11y daemonsets attribute_keysLists the metric attribute keys Kubernetes daemonsets report, for building daemonset filters.
hanzo o11y daemonsets attribute_valuesLists the values one daemonset attribute key has taken, for building daemonset filters.
hanzo o11y daemonsets listLists Kubernetes daemonsets over a time range, each with the CPU and memory its pods used against request and limit, desired and available node counts, restarts and attributes; filterable, groupable and paginated.

Dashboard views

CommandWhat it does
hanzo o11y dashboard_views createPersists the calling user's dashboard-listing state (query, sort, order) as a named, reusable view shared across the org.
hanzo o11y dashboard_views listReturns every saved view in the calling user's org.
hanzo o11y dashboard_views rm <id>Removes a saved view.
hanzo o11y dashboard_views set <id>Replaces a saved view's name and data.

Dashboards

CommandWhat it does
hanzo o11y dashboards clone <id>Clones an existing v2-shape dashboard.
hanzo o11y dashboards createCreates a dashboard in the v2 format that follows the Perses spec and answers with the stored dashboard.
hanzo o11y dashboards get <id>Returns a v2-shape dashboard.
hanzo o11y dashboards listReturns a page of v2-shape dashboards for the org.
hanzo o11y dashboards lock clear <id>Unlocks a v2-shape dashboard.
hanzo o11y dashboards lock replace <id>Locks a v2-shape dashboard.
hanzo o11y dashboards public clear <id>Deletes the public-sharing config and disables public sharing of a dashboard.
hanzo o11y dashboards public create <id>Creates the public-sharing config for a dashboard and enables public sharing, answering with the new share's id.
hanzo o11y dashboards public get <id>Returns the public-sharing config for a dashboard.
hanzo o11y dashboards public replace <id>Updates the public-sharing config for a dashboard.
hanzo o11y dashboards rm <id>Deletes a v2-shape dashboard along with its tag relations.
hanzo o11y dashboards set <id>Updates a v2-shape dashboard's metadata, spec and tag set.
hanzo o11y dashboards update <id>Applies an RFC 6902 JSON Patch to a v2-shape dashboard.

Deployments

CommandWhat it does
hanzo o11y deployments attribute_keysLists the metric attribute keys Kubernetes deployments report, for building deployment filters.
hanzo o11y deployments attribute_valuesLists the values one deployment attribute key has taken, for building deployment filters.
hanzo o11y deployments listLists Kubernetes deployments over a time range, each with the CPU and memory its pods used against request and limit, desired and available replica counts, restarts and attributes; filterable, groupable and paginated.

Downtime schedules

CommandWhat it does
hanzo o11y downtime_schedules createCreates a planned maintenance window, answering with the stored schedule.
hanzo o11y downtime_schedules get <id>Returns one planned maintenance window, by id.
hanzo o11y downtime_schedules listLists all planned maintenance windows, optionally narrowed to the active ones or the recurring ones.
hanzo o11y downtime_schedules rm <id>Removes a planned maintenance window, by id.
hanzo o11y downtime_schedules set <id>Replaces a planned maintenance window, by id.

Error tracking

CommandWhat it does
hanzo o11y errortracking issues add <id>Changes an issue's lifecycle — resolve, ignore, reopen or assign — and returns the updated issue.
hanzo o11y errortracking issues get <id>Returns one grouped issue with its latest occurrence sample.
hanzo o11y errortracking issues listLists the caller's org's grouped error issues (by fingerprint) with status, level, counts and first/last-seen.

Explorer

CommandWhat it does
hanzo o11y explorer views createSaves a new explorer view for the caller's org and returns its id.
hanzo o11y explorer views get <viewId>Returns one saved explorer view by id.
hanzo o11y explorer views listLists the caller's org's saved explorer views, optionally narrowed to one source page, name or category.
hanzo o11y explorer views rm <viewId>Deletes one saved explorer view by id.
hanzo o11y explorer views set <viewId>Replaces one saved explorer view by id with the given view and echoes it back.

Fields

CommandWhat it does
hanzo o11y fields keysReturns the telemetry field keys matching the selector — the signal's fields grouped by name, and whether the catalog is complete.
hanzo o11y fields valuesReturns the values one telemetry field has taken — string, bool, number and related values — and whether the value list is complete.

Gateway

CommandWhat it does
hanzo o11y gateway ingestion_keys createMints an ingestion key for the workspace, answering with the created key.
hanzo o11y gateway ingestion_keys limits <keyId>Sets a signal limit on an ingestion key, by key id, answering with the created limit.
hanzo o11y gateway ingestion_keys limits rm <limitId>Removes an ingestion key limit, by limit id.
hanzo o11y gateway ingestion_keys limits update <limitId>Changes an ingestion key limit, by limit id.
hanzo o11y gateway ingestion_keys listLists the workspace's ingestion keys, paginated.
hanzo o11y gateway ingestion_keys rm <keyId>Removes an ingestion key, by id.
hanzo o11y gateway ingestion_keys searchLists the workspace's ingestion keys whose name matches the search, paginated.
hanzo o11y gateway ingestion_keys update <keyId>Changes an ingestion key, by id.

Global

CommandWhat it does
hanzo o11y global configReturns the deployment's global configuration: its public endpoints and which identity providers are enabled.

Hosts

CommandWhat it does
hanzo o11y hosts attribute_keysLists the metric attribute keys hosts report, for building host filters — each with its data type and whether it is a materialized column.
hanzo o11y hosts attribute_valuesLists the values one host attribute key has taken, for building host filters — string, number and bool values in their own lists.
hanzo o11y hosts listLists monitored hosts over a time range, each with its CPU, memory, I/O wait and 15-minute load, whether it is actively reporting, its OS and its attributes; filterable, groupable and paginated.

Infra monitoring

CommandWhat it does
hanzo o11y infra_monitoring checks --type <type>Reports whether the metrics and attributes an infra-monitoring section needs are being received — for each collector receiver or processor involved, what is present and what is missing, with a user-facing message and a docs link per missing piece.
hanzo o11y infra_monitoring clustersLists Kubernetes clusters with CPU and memory usage against allocatable capacity summed over their nodes, plus per-group node readiness and pod phase counts.
hanzo o11y infra_monitoring daemonsetsLists Kubernetes daemonsets with the CPU and memory their pods used against request and limit, the latest desired and current scheduled NODE counts (node counts, not pod counts), and per-group pod phase counts.
hanzo o11y infra_monitoring deploymentsLists Kubernetes deployments with the CPU and memory their pods used against request and limit, the latest desired and available replica counts, and per-group pod phase counts.
hanzo o11y infra_monitoring hostsLists hosts with key infrastructure metrics — CPU, memory, I/O wait and disk usage percentages and 15-minute load — plus an active/inactive status from whether the host reported in the last ten minutes.
hanzo o11y infra_monitoring jobsLists Kubernetes jobs with the CPU and memory their pods used against request and limit, the latest desired-successful, active, failed and successful pod counters, and per-group pod phase counts — the phase counts are current state while the counters are cumulative over the job's life.
hanzo o11y infra_monitoring namespacesLists Kubernetes namespaces with the CPU and memory their pods used and per-group pod phase counts.
hanzo o11y infra_monitoring nodesLists Kubernetes nodes with CPU and memory usage against allocatable capacity, per-group readiness counts and per-group phase counts for the pods scheduled on them.
hanzo o11y infra_monitoring podsLists Kubernetes pods with CPU and memory usage against request and limit, the pod's phase and its age, plus its namespace, node, owning workload and cluster attributes.
hanzo o11y infra_monitoring pvcsLists Kubernetes persistent volume claims with available, capacity and used bytes and inode counts, plus the claim's pod, namespace, node, statefulset and cluster attributes.
hanzo o11y infra_monitoring statefulsetsLists Kubernetes statefulsets with the CPU and memory their pods used against request and limit, the latest desired and current replica counts, and per-group pod phase counts.

Infra onboarding

CommandWhat it does
hanzo o11y infra_onboarding k8s statusReports how far Kubernetes infra onboarding has progressed: which metric families have arrived and, per pod, which required metadata labels are present.

Integrations

CommandWhat it does
hanzo o11y integrations connection_status <integrationId>Reports whether the integration's logs and metrics have been received over the lookback window, so the console can show a live connection state.
hanzo o11y integrations get <integrationId>Returns one integration's full detail — its overview, configuration steps, collected data and assets — together with its installation record when the org has installed it.
hanzo o11y integrations installInstalls an integration into the caller's org from its id and configuration, answering with the installed catalog item.
hanzo o11y integrations listLists the available integrations and whether each is installed in the caller's org, optionally narrowed to installed or not-installed.
hanzo o11y integrations uninstallRemoves an integration from the caller's org by id.

Jobs

CommandWhat it does
hanzo o11y jobs attribute_keysLists the metric attribute keys Kubernetes jobs report, for building job filters.
hanzo o11y jobs attribute_valuesLists the values one job attribute key has taken, for building job filters.
hanzo o11y jobs listLists Kubernetes jobs over a time range, each with the CPU and memory its pods used against request and limit, desired-successful, active, failed and successful pod counts, restarts and attributes; filterable, groupable and paginated.

Licenses

CommandWhat it does
hanzo o11y licenses activeActivates the enterprise license.
hanzo o11y licenses getLists the org's licenses.

LLM

CommandWhat it does
hanzo o11y llm annotation createAdds a human annotation to a trace or observation, optionally in a review queue.
hanzo o11y llm annotation getLists human annotations on traces and observations, optionally scoped to one review queue.
hanzo o11y llm observationsLists gen_ai spans as LLM observations — each an LLM call with its model, token counts, cost and latency projected from gen_ai.* attributes, newest first, over the query window.
hanzo o11y llm score get <id>Returns a single score by id.
hanzo o11y llm score rm <id>Hard-deletes a score by id.
hanzo o11y llm scores createAttaches an eval score or human-feedback signal to a trace or a single observation.
hanzo o11y llm scores getLists eval scores and human-feedback signals attached to traces and observations, newest first.
hanzo o11y llm sessionsLists conversations — gen_ai spans grouped by session.id, with their trace and observation counts, tokens and cost.
hanzo o11y llm tracesLists LLM traces — gen_ai spans grouped by trace_id, with cost, tokens and latency rolled up across each trace.
hanzo o11y llm usersLists end users — gen_ai spans grouped by user.id, with their session, trace and observation counts, tokens and cost.

LLM pricing rules

CommandWhat it does
hanzo o11y llm_pricing_rules get <id>Returns a single LLM pricing rule by id.
hanzo o11y llm_pricing_rules listReturns the LLM pricing rules for the caller's org, with pagination and an optional search and override filter.
hanzo o11y llm_pricing_rules replaceWrites the pricing-rule batch — the single write endpoint used by both the user and the Zeus sync job.
hanzo o11y llm_pricing_rules rm <id>Hard-deletes a pricing rule by id.

Logs

CommandWhat it does
hanzo o11y logs aggregateReturns the logs aggregate buckets for the query window.
hanzo o11y logs fields create --data-type <dataType> --name <name> --type <type>Changes how one log field is stored — selects or deselects it as a materialized column and tunes its index — and echoes the setting back.
hanzo o11y logs fields getReturns the log field catalog: the fields already selected as indexed columns, and the interesting ones seen in the data that could be.
hanzo o11y logs getReturns the most recent log records in the query window, newest first — each record an open object carrying its nanosecond timestamp and whatever fields the record was ingested with.
hanzo o11y logs livetailFollow log records as they arrive
hanzo o11y logs pipelines createSaves the given log parsing pipelines as the new config version for the caller's org and starts deploying it.
hanzo o11y logs pipelines get <version>Returns the caller's org's log parsing pipelines at one config version — "latest" for the newest — along with that version's deployment record and the recent version history.
hanzo o11y logs pipelines previewRuns the given log parsing pipelines over the given sample records without saving anything, and returns the transformed records plus whatever the collector logged while simulating them.
hanzo o11y logs promote_paths createPromotes and indexes log body paths: each named path is lifted out of the JSON body into its own column, with the indexes the caller asked for.
hanzo o11y logs promote_paths getLists the log body paths already promoted or indexed, with the indexes each carries.

Messaging queues

CommandWhat it does
hanzo o11y messaging-queues kafka consumer-lag consumer-detailsReturns the consumer side of a consumer-lag view: the consumer groups reading the topic/partition named in variables, with their throughput and latency over the window.
hanzo o11y messaging-queues kafka consumer-lag network-latencyReturns consumer network latency correlated per client: a throughput pass over the window finds the consumer clients, then their fetch latency joins in as a latency column per client/instance/service.
hanzo o11y messaging-queues kafka consumer-lag producer-detailsReturns the producer side of a consumer-lag view: the producers writing to the topic/partition named in variables, with their throughput and latency over the window.
hanzo o11y messaging-queues kafka onboarding consumersChecks whether the spans the Kafka consumer views need are arriving, row for row like producersOnboarding.
hanzo o11y messaging-queues kafka onboarding kafkaChecks whether Kafka's own metrics — consumer lag and partition telemetry — are arriving, so the lag views can be lit up.
hanzo o11y messaging-queues kafka onboarding producersChecks whether the spans the Kafka producer views need are arriving — one row per required span attribute, with a pass/fail status and, on failure, what is missing from the instrumentation.
hanzo o11y messaging-queues kafka partition-latency consumerReturns the consumer-group latency detail for the topic and partition named in the request's variables.
hanzo o11y messaging-queues kafka partition-latency overviewReturns the per-partition latency overview for the window — each topic/partition with its throughput and latency profile.
hanzo o11y messaging-queues kafka span evaluationCorrelates producer and consumer spans over the evaluation window (eval_time bounds the scan) and returns the pairings with their end-to-end delay — the check that messages produced are being consumed.
hanzo o11y messaging-queues kafka topic-throughput consumerReturns the consumer topic-throughput overview for the window — what each consumer group read, per topic.
hanzo o11y messaging-queues kafka topic-throughput consumer-detailsBreaks one consumer topic's throughput down using the topic and service named in variables.
hanzo o11y messaging-queues kafka topic-throughput producerReturns the producer topic-throughput overview for the window — what each producer service wrote, per topic.
hanzo o11y messaging-queues kafka topic-throughput producer-detailsBreaks one producer topic's throughput down using the topic and service named in variables.
hanzo o11y messaging-queues queue-overviewLists the messaging destinations observed in the window — one row per queue/destination/service combination with its throughput and latency columns.

Metric

CommandWhat it does
hanzo o11y metric metric_metadataServes the OLDER /metric/metric_metadata route.

Metric reduction rules

CommandWhat it does
hanzo o11y metric_reduction_rules create --labels '["<labels>"]' --match-type <matchType> --metric-name <metricName>Creates a volume-control rule for a metric and returns it with its id; a metric that already has a rule is refused.
hanzo o11y metric_reduction_rules get <id>Returns one volume-control rule by its id.
hanzo o11y metric_reduction_rules listLists the org's metric volume-control (label reduction) rules, pageable and sortable by name, volume or recency.
hanzo o11y metric_reduction_rules preview --labels '["<labels>"]' --match-type <matchType> --metric-name <metricName>Estimates the series reduction and the dashboards and alerts a candidate volume-control rule would touch, without persisting it.
hanzo o11y metric_reduction_rules rm <id>Deletes a volume-control rule by its id.
hanzo o11y metric_reduction_rules set <id> --labels '["<labels>"]' --match-type <matchType>Updates the match type and labels of a volume-control rule by its id; the metric name is immutable.
hanzo o11y metric_reduction_rules statsReturns total ingested vs retained series and samples and the estimated monthly savings across all volume-control rules.
hanzo o11y metric_reduction_rules timeseriesReturns ingested vs retained series over time across all volume-control rules, in hourly buckets, in the query-range time-series response shape.

Metrics

CommandWhat it does
hanzo o11y metrics alerts --metric-name <metric-name>Lists the alert rules that reference a metric.
hanzo o11y metrics attributes --metric-name <metric-name>Returns one metric's attribute keys, each with its unique values and their count.
hanzo o11y metrics dashboards --metric-name <metric-name>Lists the dashboard panels that reference a metric.
hanzo o11y metrics getLists the distinct metric names seen in a time range, each with its description, type, unit, temporality and monotonicity.
hanzo o11y metrics highlights --metric-name <metric-name>Returns one metric's headline numbers: data points, total and active time series, and when it was last received.
hanzo o11y metrics inspect --end 0 --metric-name <metricName> --start 0Returns one metric's raw time series over a window of at most thirty minutes — each series with its labels and timestamp/value pairs.
hanzo o11y metrics metadata create --metric-name <metricName>Updates one metric's metadata — description, type, unit, temporality, monotonicity — and answers with the bare success envelope.
hanzo o11y metrics metadata get --metric-name <metric-name>Returns one metric's metadata: description, type, unit, temporality and monotonicity.
hanzo o11y metrics onboardingReports whether any non-O11y metrics have been ingested — the lightweight check onboarding polls.
hanzo o11y metrics stats --end 0 --limit 0 --start 0Lists metrics with their sample and time-series counts for a time range — the volume view of the metrics explorer, pageable and sortable.
hanzo o11y metrics treemap --end 0 --limit 0 --mode <mode> --start 0Returns the proportional distribution of metrics by sample count or time-series count, as the entries of a treemap.

Namespaces

CommandWhat it does
hanzo o11y namespaces attribute_keysLists the metric attribute keys Kubernetes namespaces report, for building namespace filters.
hanzo o11y namespaces attribute_valuesLists the values one namespace attribute key has taken, for building namespace filters.
hanzo o11y namespaces listLists Kubernetes namespaces over a time range, each with the CPU and memory its pods used, their phase counts and its attributes; filterable, groupable and paginated.

Nodes

CommandWhat it does
hanzo o11y nodes attribute_keysLists the metric attribute keys Kubernetes nodes report, for building node filters.
hanzo o11y nodes attribute_valuesLists the values one node attribute key has taken, for building node filters.
hanzo o11y nodes listLists Kubernetes nodes over a time range, each with its CPU and memory usage against allocatable capacity, readiness condition counts and attributes; filterable, groupable and paginated.

Org

CommandWhat it does
hanzo o11y org preferences get <name>Returns one org-scoped preference, by name.
hanzo o11y org preferences listLists every org-scoped preference, each with its current and default value.
hanzo o11y org preferences set <name>Sets one org-scoped preference, by name.

Orgs

CommandWhat it does
hanzo o11y orgs me filters get <signal>Returns the org's quick filters for one signal — traces, logs, metrics, exceptions or api_monitoring.
hanzo o11y orgs me filters listReturns the org's quick filters for every signal — the attribute shortlists its explorers offer as one-click filters.
hanzo o11y orgs me filters replaceReplaces the org's quick filters for one signal with the attribute list given.
hanzo o11y orgs me getReturns the caller's own organization.
hanzo o11y orgs me replaceRewrites the caller's own organization record — display name, name, alias — always addressed as "me", never by id.

Pods

CommandWhat it does
hanzo o11y pods attribute_keysLists the metric attribute keys Kubernetes pods report, for building pod filters.
hanzo o11y pods attribute_valuesLists the values one pod attribute key has taken, for building pod filters.
hanzo o11y pods listLists Kubernetes pods over a time range, each with its CPU and memory usage against request and limit, restart count, phase counts and attributes; filterable, groupable and paginated.

Processes

CommandWhat it does
hanzo o11y processes attribute_keysLists the metric attribute keys processes report, for building process filters.
hanzo o11y processes attribute_valuesLists the values one process attribute key has taken, for building process filters.
hanzo o11y processes listLists monitored processes over a time range, each with its name, PID, command line and CPU and memory usage; filterable, groupable and paginated.

Product

CommandWhat it does
hanzo o11y product metricsReturns one product's RED series — request rate, errors, p50 and p95 latency — for the caller's org, plus that org's LLM usage rollup over the same window.

Public

CommandWhat it does
hanzo o11y public dashboards get <id>Returns the sanitized dashboard data for public access — the read a shared dashboard's public page makes.
hanzo o11y public dashboards widgets query_range <id> <idx>Returns the query-range result for one widget of a public dashboard.

PVCs

CommandWhat it does
hanzo o11y pvcs attribute_keysLists the metric attribute keys persistent volume claims report, for building volume filters.
hanzo o11y pvcs attribute_valuesLists the values one persistent-volume-claim attribute key has taken, for building volume filters.
hanzo o11y pvcs listLists Kubernetes persistent volume claims over a time range, each with its available, capacity and used bytes, inode counts and attributes; filterable, groupable and paginated.

Query filter

CommandWhat it does
hanzo o11y query_filter analyze --query <query> --query-type <queryType>Analyzes a query and extracts the metric names it reads and the columns it groups by.

Query range

CommandWhat it does
hanzo o11y query_range createExecutes a composite query over a time range: builder queries over traces, logs and metrics, formulas, trace operators, PromQL and Datastore SQL, answering time series, scalars or raw records as the request type asks.
hanzo o11y query_range formatParses a builder query and echoes it back normalized to the v3 shape — the endpoint the UI uses to canonicalize a query without running it.
hanzo o11y query_range get --start <start> --end <end> --step <step> --query <query>Runs a Prometheus-style range query over metrics — the legacy read that predates the v5 querier — and returns the matrix, vector or scalar the query resolved to.
hanzo o11y query_range previewValidates a composite query and renders the Datastore statements it would run WITHOUT executing it — a dry run for agentic and tooling use.

Reviews

CommandWhat it does
hanzo o11y reviews createCreates a human-review queue in the caller's org and project.
hanzo o11y reviews get <id>Returns one review queue with its pending and completed counts and its first page of items.
hanzo o11y reviews items create <id>Enqueues traces, observations or sessions on a review queue.
hanzo o11y reviews items list <id>Returns a page of one review queue's items, newest first, optionally filtered to PENDING or COMPLETED.
hanzo o11y reviews items update <id> <itemId>Moves one queue item between PENDING and COMPLETED and sets its assignee.
hanzo o11y reviews listReturns a page of the caller org's human-review queues, newest first, narrowed to the caller's project.
hanzo o11y reviews rm <id>Removes one review queue and every item in it.
hanzo o11y reviews update <id>Changes a review queue's name, description or score-config set.

Roles

CommandWhat it does
hanzo o11y roles createCreates a custom role in the caller's org from a name, an optional description and the transaction groups it grants, answering the new role's id.
hanzo o11y roles get <id>Returns one role with the transaction groups it grants.
hanzo o11y roles listLists every role in the caller's org — the managed ones the platform seeds and the custom ones its admins created.
hanzo o11y roles rm <id>Deletes a custom role.
hanzo o11y roles set <id>Replaces a custom role's description and transaction groups.

Route policies

CommandWhat it does
hanzo o11y route_policies createCreates a route policy, answering with the stored policy.
hanzo o11y route_policies get <id>Returns one route policy, by id.
hanzo o11y route_policies listLists the org's route policies.
hanzo o11y route_policies rm <id>Removes a route policy, by id.
hanzo o11y route_policies set <id>Replaces a route policy, by id, answering with the stored policy.

Rules

CommandWhat it does
hanzo o11y rules createCreates a new alert rule and answers with the stored rule.
hanzo o11y rules get <id>Returns one alert rule with its evaluation state, by id.
hanzo o11y rules history filter_keys <id>Returns the distinct label keys present in a rule's history entries over the selected range, for building history filters.
hanzo o11y rules history filter_values <id> --name <name>Returns the distinct values a given label key has taken across a rule's history entries.
hanzo o11y rules history overall_status create <id>Returns the overall firing/inactive windows for a rule, for the posted query range.
hanzo o11y rules history overall_status get <id>Returns the overall firing/inactive intervals for a rule over the selected range.
hanzo o11y rules history stats create <id>Returns trigger and resolution statistics for a rule, current window against the prior one, for the posted query range.
hanzo o11y rules history stats get <id>Returns trigger and resolution statistics for a rule over the selected time range, current window against the prior one.
hanzo o11y rules history timeline create <id>Returns a rule's state-transition timeline for the posted query range, each entry carrying its related-logs or related-traces link.
hanzo o11y rules history timeline get <id>Returns paginated timeline entries for a rule's state transitions, filterable by state and a label expression, cursor-paginated.
hanzo o11y rules history top_contributors create <id>Returns the label combinations that contributed most to a rule firing, for the posted query range.
hanzo o11y rules history top_contributors get <id>Returns the label combinations that contributed most to a rule firing over the selected range.
hanzo o11y rules listLists all alert rules with their current evaluation state.
hanzo o11y rules rm <id>Removes an alert rule, by id.
hanzo o11y rules set <id>Replaces an alert rule's definition, by id.
hanzo o11y rules testFires a test notification for a rule definition without saving it, answering with how many series would alert.
hanzo o11y rules update <id>Applies a partial update to an alert rule, by id, answering with the stored rule — the common toggle for enabling or muting a rule.

Sentinel

CommandWhat it does
hanzo o11y sentinel discover --project <project>Aggregates a project's captured errors into a table — the caller names the filters, the groupings and the aggregations, and gets back the columns and rows they asked for.
hanzo o11y sentinel events get <id> --project <project>Returns one captured error event of a project, by its id.
hanzo o11y sentinel issues events <id> --project <project>Lists one issue's captured occurrences, scoped to a project — a project is an isolation unit, so the caller declares which project's occurrences to read.
hanzo o11y sentinel issues get <id>Returns one grouped issue of the caller's org with its latest occurrence sample.
hanzo o11y sentinel issues listLists the caller's org's grouped error issues, optionally narrowed to one project and one time window, and filtered by status, level, environment, service, a free-text query and a sort.
hanzo o11y sentinel issues set <id>Changes an issue's lifecycle — resolve, ignore, reopen or assign — and returns the updated issue.
hanzo o11y sentinel logs --project <project>Lists a project's captured error events, newest first, optionally narrowed to those whose message or exception text contains a search string.
hanzo o11y sentinel projects create --name <name>Creates a Sentry project under the caller's org and returns it.
hanzo o11y sentinel projects get <id>Returns one Sentry project of the caller's org.
hanzo o11y sentinel projects listLists the caller's org's Sentry projects — one per product that has reported an error, plus any created by hand.
hanzo o11y sentinel projects rm <id>Deletes one Sentry project of the caller's org; retained events are not touched.
hanzo o11y sentinel stats --project <project>Returns a project's event-rate timeseries: one bucket per interval over the requested period, counting the events in it.
hanzo o11y sentinel traces get <id> --project <project>Returns one trace's captured errors for a project — every error event that carried the trace id, in the order the events plane holds them.
hanzo o11y sentinel traces list --project <project>Lists the traces a project's captured errors reference, each with how many errors landed on it, when they started and stopped, and the latest message seen — the entry point for "which requests are failing".

Service

CommandWhat it does
hanzo o11y service entry_point_operationsReturns one service's entry-point operations with the same latency and error profile topOperations reports.
hanzo o11y service top_level_operationsMaps each service to its entry-point span names — for the one service named in the request, or for every service when none is.
hanzo o11y service top_operationsReturns one service's heaviest operations in the window, each with p50/p95/p99 latency, how often it ran and how often it errored.

Service accounts

CommandWhat it does
hanzo o11y service_accounts createCreates a service account in the caller's org, answering its id.
hanzo o11y service_accounts get <id>Returns one service account with the roles it holds.
hanzo o11y service_accounts keys create <id>Mints an API key for a service account and answers the key's id and its secret — the one time the secret is ever shown.
hanzo o11y service_accounts keys list <id>Lists a service account's API keys — metadata only, never the secrets.
hanzo o11y service_accounts keys rm <id> <fid>Revokes an API key.
hanzo o11y service_accounts keys set <id> <fid>Renames an API key or moves its expiry.
hanzo o11y service_accounts listLists the caller's org's service accounts.
hanzo o11y service_accounts me getReturns the calling service account itself, with the roles it holds — the self-inspection read for a key-authenticated caller.
hanzo o11y service_accounts me replaceRenames the calling service account.
hanzo o11y service_accounts rm <id>Deletes a service account and revokes every key it holds.
hanzo o11y service_accounts roles create <id>Assigns a role, named by its id, to a service account.
hanzo o11y service_accounts roles list <id>Lists the roles a service account holds.
hanzo o11y service_accounts roles rm <id> <rid>Removes a role from a service account.
hanzo o11y service_accounts set <id>Renames a service account.

Services

CommandWhat it does
hanzo o11y services createLists the instrumented services seen in the window, each with the request profile of its entry-point spans: p99 and average latency, call and error rates, and the entry-point operations the numbers were computed over.
hanzo o11y services listLists the name of every service the trace store holds, with no window applied — the complete catalog, for pickers and autocomplete.

Settings

CommandWhat it does
hanzo o11y settings apdex createSets one service's apdex threshold and the status codes excluded from its score.
hanzo o11y settings apdex getReturns apdex settings for the named services.
hanzo o11y settings ttl createSets the org's retention policy for one signal: the default TTL in days, ordered per-label retention rules, and optional cold-storage settings.
hanzo o11y settings ttl getReturns the org's current retention policy: default TTL, custom per-label rules, and cold-storage settings where configured.

Span mapper groups

CommandWhat it does
hanzo o11y span_mapper_groups createCreates a mapping group: the name it is known by, the span and resource attributes whose presence selects a span into it, and whether it is on.
hanzo o11y span_mapper_groups listLists the caller's org's mapping groups, optionally only the enabled ones.
hanzo o11y span_mapper_groups rm <groupId>Deletes a mapping group and every mapper under it.
hanzo o11y span_mapper_groups span_mappers create <groupId>Adds a mapper to a group: which field context it reads, the move or copy it performs, and whether it is on.
hanzo o11y span_mapper_groups span_mappers list <groupId>Lists the mappers belonging to one group, in the order they are applied.
hanzo o11y span_mapper_groups span_mappers rm <groupId> <mapperId>Deletes one mapper from a group.
hanzo o11y span_mapper_groups span_mappers update <groupId> <mapperId>Changes a mapper's field context, config or enabled state.
hanzo o11y span_mapper_groups update <groupId>Changes a group's name, condition or enabled state.

Statefulsets

CommandWhat it does
hanzo o11y statefulsets attribute_keysLists the metric attribute keys Kubernetes statefulsets report, for building statefulset filters.
hanzo o11y statefulsets attribute_valuesLists the values one statefulset attribute key has taken, for building statefulset filters.
hanzo o11y statefulsets listLists Kubernetes statefulsets over a time range, each with the CPU and memory its pods used against request and limit, desired and available replica counts, restarts and attributes; filterable, groupable and paginated.

Third party APIs

CommandWhat it does
hanzo o11y third-party-apis overview domainReturns one external domain's endpoint-level breakdown — each endpoint with its rate, error and latency columns over the window.
hanzo o11y third-party-apis overview listLists the external domains the instrumented services call, with request rate, error percentage and latency per domain.

Trace funnels

CommandWhat it does
hanzo o11y trace-funnels analytics error-traces <funnel_id>Returns the errored traces through a step transition of a saved funnel — the entry point for "why is this step failing".
hanzo o11y trace-funnels analytics error-traces-allReturns the errored traces through a step transition of a funnel described inline.
hanzo o11y trace-funnels analytics overview <funnel_id>Returns a saved funnel's conversion overview over a window: how many entered, how many converted, the rate and the latency.
hanzo o11y trace-funnels analytics overview-allReturns the conversion overview of a funnel described inline.
hanzo o11y trace-funnels analytics slow-traces <funnel_id>Returns the slowest traces through a step transition of a saved funnel — the entry point for "why is this step slow".
hanzo o11y trace-funnels analytics slow-traces-allReturns the slowest traces through a step transition of a funnel described inline.
hanzo o11y trace-funnels analytics steps create <funnel_id>Returns a saved funnel's per-step metrics over a window — the counts and latencies at each step, in step order.
hanzo o11y trace-funnels analytics steps create-allReturns the per-step metrics of a funnel described inline.
hanzo o11y trace-funnels analytics steps overview <funnel_id>Returns the conversion between two named steps of a saved funnel — the step-to-step drill-down behind the overview.
hanzo o11y trace-funnels analytics steps overview-allReturns the conversion between two steps of a funnel described inline.
hanzo o11y trace-funnels analytics validate <funnel_id>Lists the traces that match a saved funnel over a window — the read that answers "is this funnel finding anything at all".
hanzo o11y trace-funnels analytics validate-allLists the traces that match a funnel described inline — the builder's "try this" before anything is saved.
hanzo o11y trace-funnels get <funnel_id>Returns one funnel with its steps.
hanzo o11y trace-funnels listLists the caller's org's funnels, each with its steps and who last touched it.
hanzo o11y trace-funnels newCreates an empty funnel with a name, answering the funnel it created.
hanzo o11y trace-funnels rm <funnel_id>Deletes a funnel.
hanzo o11y trace-funnels set <funnel_id>Renames a funnel or rewrites its description, answering the funnel as it now stands.
hanzo o11y trace-funnels steps updateReplaces a funnel's steps — the funnel is named in the body rather than the path — and answers the funnel as it now stands.

Traces

CommandWhat it does
hanzo o11y traces aggregations <traceId>Computes span aggregations over one trace — span count, duration or share of execution time — grouped by the resource field each aggregation names.
hanzo o11y traces fields create --data-type <dataType> --name <name> --type <type>Changes how one span field is stored — selects or deselects it as a materialized column and tunes its index — and echoes the setting back.
hanzo o11y traces fields getReturns the trace field catalog: the span fields already selected as indexed columns, and the interesting ones seen in the data that could be.
hanzo o11y traces flamegraph <traceId>Returns a trace's flamegraph: spans bucketed by depth level, each level ordered as it is drawn, around the selected span.
hanzo o11y traces get <traceId>Returns one trace's spans as a column/row table, optionally centred on a span and walked a fixed number of levels up and down from it — the read the trace explorer opens a trace with.
hanzo o11y traces listLists the caller org's recent traces — one row per trace with its span count and wall-clock duration, most recently active first.
hanzo o11y traces waterfall <traceId>Returns a trace's waterfall: every span when the trace is small enough, a capped window around the selected span when it is not, with the uncollapsed subtrees the caller asked to keep open.

User

CommandWhat it does
hanzo o11y user preferences get <name>Returns one preference of the calling user, by name.
hanzo o11y user preferences listLists every preference of the calling user, each with its current and default value.
hanzo o11y user preferences set <name>Sets one preference of the calling user, by name.

Users

CommandWhat it does
hanzo o11y users me dashboards listDashboard list V2 personalized for the calling user: each dashboard carries the caller's pinned state, and pinned dashboards float to the top of the requested ordering.
hanzo o11y users me dashboards pins clear <id>Removes the caller's pin for a dashboard.
hanzo o11y users me dashboards pins replace <id>Pins a dashboard for the calling user.
hanzo o11y users me getReturns the calling user together with every role they hold.

Variables

CommandWhat it does
hanzo o11y variables query --query <query>Evaluates a dashboard variable query and returns the values the variable may take.

Zeus

CommandWhat it does
hanzo o11y zeus hosts getReturns the deployment's host info from Zeus.
hanzo o11y zeus hosts replaceRecords the deployment's host in Zeus, overwriting any prior one.
hanzo o11y zeus profilesRecords the deployment's profile in Zeus — how the team uses observability today and what they plan — overwriting any prior one.
Was this page useful?