/clickhouse-system-queries

name: clickhouse-system-queries
description: >
  Query ClickHouse system tables to inspect query logs, monitor cluster health,
  check replication status, and analyze slow queries. Use when the user mentions
  "system tables", "query_log", "ClickHouse monitoring", "cluster status",
  "slow queries", or asks to diagnose ClickHouse operational issues.
metadata:
  author: DataStoria
  disable-slash-command: true

ClickHouse System Queries Skill

Use this skill when the user asks for operational inspection on ClickHouse `system.*` tables.

Current table coverage:

• `system.query_log` via `references/system-query-log.md`

Relationship to `sql-expert`:

• `sql-expert` handles general SQL generation and user/business tables.
• This skill handles system-table operational patterns and routing to table-specific references.

System Metrics and ProfileEvents

• Confirm column shape from schema/reference before writing predicates.
• If the user named an exact metric, pass it in the `columns` list via `explore_schema` instead of loading the full table schema.
• If `ProfileEvents` is a `Map`, access entries as `ProfileEvents['Name']`. If flattened, use `ProfileEvent_Name`.

Example — map vs flattened access:

-- Map access
SELECT ProfileEvents['DistributedConnectionFailTry'] AS fails
FROM system.query_log WHERE event_date = today();

-- Flattened column access
SELECT ProfileEvent_DistributedConnectionFailTry AS fails
FROM system.query_log WHERE event_date = today();

Workflow

1. **Resolve target** — identify system table and intent. Inherit the most recent time window from conversation, or default to last 60 minutes.

2. **Load reference** — for `system.query_log`, call `skill_resource` to load `references/system-query-log.md` before writing any SQL. For unsupported tables, fall back to `sql-expert`.

3. **Execute** — choose the right tool:

• `search_query_log` for standard ranked searches and filtered lookups
• `execute_sql` for visualization, time-bucketed aggregation, trends, or histograms

   -- search_query_log: standard lookup
   -- finds top 10 slowest queries in the last hour

   -- execute_sql: time-bucketed visualization
   SELECT toStartOfFiveMinutes(event_time) AS bucket,
          count() AS queries,
          avg(query_duration_ms) AS avg_ms
   FROM system.query_log
   WHERE event_date = today() AND event_time > now() - INTERVAL 1 HOUR
   GROUP BY bucket ORDER BY bucket

Default to `LIMIT 50` unless the user specifies otherwise.

4. **Summarize** with concise findings and next actions.

Guardrails

• Always apply time bounds for log-like system tables
• Always use the table-specific reference when available
• Never generate `system.query_log` SQL until `references/system-query-log.md` is loaded in the current turn
• Never use `search_query_log` for chart-oriented requests
• Never omit `LIMIT` in exploratory queries