Watch a running filter

Once a filter is scoring, three places tell you how it is doing. The Overview tab says what its events became and whether it is safe. Activity lists everything that happened to it, newest first. Filtered events answers “was event X filtered here, and on what basis?” This guide walks through reading each one.

When you’d do this

A filter is in shadow and you want to know what it would filter before you approve a threshold.
A filter is filtering and you check on it routinely, or after an alert.
Someone asks whether a specific alert or ticket was kept from the agent.

Before you start

Any role can read all three screens. You need a filter that is past authoring: a filter in draft or authoring reads nothing yet, so its Overview shows only its setup steps.

Read the Overview

Open the filter from the Filters page and select the Overview tab.
Read the line under the header, if there is one.

It is what the Actions tab leads with: a Fault, Attention, Setup or Recommendation badge and Sift’s reason, or the current setup step as Step n of N with a progress meter. Select Open in Actions to act on it (see Work through Actions). No line means nothing is owed.
Pick a window with the 1d, 7d, 30d or 90d buttons. The default is 7 days. The window applies to every section on the page that reads one.
Read the flow at the top.

It follows each scored event from the stage that filtered it, or let it through, to the agent’s verdict. A red band is an actionable verdict on an event the filter filtered or would have: a miss.
- On an active filter, under the flow: Runs avoided and Share filtered, each against the window before.
- On a filter in shadow, the flow is titled If it were filtering, and the figure under it is Actionable it would filter, with the share of events it would filter.
- On a proposed filter, the flow sits beside Threshold decision, which links to Review threshold.
- Runs saved by grouping appears only on a filter that has used Shape delivery. It is never added into runs avoided.
The foot of the flow shows the approval, any version waiting for approval, and the filter’s leak-through rate. How this is measured lists which stage, recipe and model produced the numbers.
Read Every day.

The bars are events by day: what each stage filtered (Collapsed, Filtered, or Would have… on a filter that is not filtering), what an active filter would have filtered but let through (Would filter), and Escalated. The Agent runs line sits over them. Under the bars, Omission rate is the actionable share of the leak-through sample over the seven days to each point, against its limit.

Read Is it safe and its verdict badge.

Badge	Meaning
Within limits	Live recall is measured and within what the approval was held to.
Above limit	Live recall is below the approval’s line, by the drift alarm’s own rule.
Not yet measurable	Too few leak-through or escalation verdicts (about 20 each) to give a rate.
Drift breached	One of the drift readings is over its alarm level.
A condition word	Sift has raised a safety condition, such as Drift alarm, Fell back on drift, Approval withdrawn, Model stale or Collapse runaway.

The Miss rate meter shows the share of actionable events the filter filtered, against its limit. The Recall estimate meter shows live recall with its 95% interval, against what the approval was held to. Both count from the current approval, or the pairing, when that falls inside the window. See How Sift measures a filter for how they are estimated.

Read the Drift rows: Firing rate, Missed actionable events, Score shift and Feature PSI. Each shows its latest reading in the last 30 days against its alarm level, with OK or Breached, and acknowledged where a person resumed the filter over that breach.
Read Model age against the retrain schedule, and Busiest hour against the trigger ceiling. Busiest hour appears only for a window in which the filter filtered, because the ceiling only counts then.
Scroll to Ingest and delivery. Its badge reads Healthy when polls succeed and nothing is wrong with delivery. It shows polls in the last 24 hours, any last error, how the window’s sends to the agent ended, the time to verdict, and how verdicts arrived (written, stated or guessed).
Read Agent load, beside Ingest and delivery, where the filter has an agent budget, Shape delivery holds groups, or Sift raises a load condition. See Agent load.
Read Recently for the last five notable events (state changes, approvals, waiting versions, drift breaches), and select All activity for the rest.

Agent load

Every queue that can fill shows how full it is here. The panel’s badge is the load condition Sift raises, or Within limits; Settings opens Settings › Delivery › Agent load.

Part	What it shows
Runs this hour	The runs the filter started in the last hour against its agent budget, marked where Sift warns. at budget when it binds. Absent (“not readable now”) when Sift cannot count the runs in flight.
Waiting	Escalations held in the budget’s queue against its depth, marked where Sift warns. filling past that mark.
Oldest	How long the oldest has waited, against the longest wait. “nothing waiting” when the queue is empty.
Sent late (24 h)	Held escalations sent once there was room, with the median wait.
Aged out, Pushed out, Recorded only	Escalations that left unsent in the last 24 hours: past the longest wait, pushed out of a full queue, or recorded under Record only. In red, with not seen by the agent, when any.
Events held for a group	Escalations Shape delivery holds, against what the open groups may hold, and how many groups.
Oldest group	The oldest group’s age against its wait. past due when the budget holds it longer.

A filter with no budget shows “No agent budget is set.” With no group open, the two group rows give way to one line, “No groups open.” None of these is ever counted as filtered. On a filter that samples in shadow, the flow’s heading also says what it sends, such as Sending one in twenty (guided), and the flow draws what it did not send as its own path, Not sent.

Badge	Meaning
Losing events	Escalations aged out or were pushed out in the last hour. A fault.
At budget	The budget bound in the last hour and escalations wait.
Queue filling	The queue’s depth or its oldest item passed the warning share.
Recording overflow	Under Record only, escalations were recorded and not sent.
Near budget	Runs reached the warning share in two of the last three hours.
Over capacity	No budget, and shadow started more runs than the agent can take for two hours.
Groups overdue	A held group is past its release.

Read Activity

Select the Activity tab.
Narrow the list with the chips. Everything shows all kinds; the others are State, Approvals, Versions, Gold set, Pairing, Delivery, Agent load, Drift, Training, Polls, Agent runs, Verdicts, Rescues and Other. You can select several.
Set When to All, Last hour, Last day or Last week.
Set Polls with nothing new. Grouped (the default) folds a run of quiet polls into one row; a failed poll is never folded. Each one lists them all; Hidden leaves them out.
Open any row to see its detail: the reason a person gave, what Sift did, a poll’s events read and new and its source lag, or a run id.

An agent run that was sent more than once lists every send. When Sift sent an event again because the answer to an earlier send was lost, the row shows Why it was sent again, which is what the agent was told.
Select Older at the foot to load more.

The address keeps your choices, so you can paste a link to “every state change in the last day” into a ticket.

Find a filtered event

On the Activity tab, select Filtered events.
Under Search, type the event’s id as your source system spells it in Source event id. It is an exact match.
Optionally set From (inclusive) and To (exclusive), in your local time zone.
Select Search.

The Filtered events table lists each match with its Score, the Model version that scored it, and Filtered at, most recent first. Load more pages through the rest.

The list keeps every event the filter filtered, whichever stage filtered it, for 400 days by default (the operator can change it). It holds no event payloads, by design: to see the event itself, look it up in your source system by its id. Leak-through events reached the agent, so they are not in it.

What healthy looks like

No line under the header, and no Attention or Fault badge beside the state.
Is it safe reads Within limits, and every drift row reads OK.
The flow has little or no red, and the omission rate sits under its limit.
Ingest and delivery reads Healthy, and Agent load, where it is shown, reads Within limits.

What needs attention

You see	What it means	Where to go
A Fault badge or Polls failing	Something is not doing what the console says, such as a failing source or escalations not reaching the agent.	Work through Actions
Above limit or a breached drift row	The filter may be missing more than it was approved to.	Actions; by default Sift falls the filter back to shadow on a drift alarm. See Hold, stop, resume or retire a filter.
Fell back on drift or Fell back on its ceiling	Sift stopped the filter filtering and withdrew its approval.	Hold, stop, resume or retire a filter
Model age marked overdue	The model is older than its retrain schedule.	Actions offers a retrain.
Losing events or At budget on Agent load	The budget cannot keep up with what the filter sends.	Settings › Delivery › Agent load: raise the budget or the queue, or accept it.
Most labels are guesses under Ingest and delivery	The agent is not stating its verdict, so labels are Sift’s reading of prose.	Paste the briefing from Briefing for the agent into the agent’s prompt. See The paired agent.