Triage logo
Triage User guide

User guide

Working failed messages in Triage

A task-oriented guide for the people who actually resolve dead-letter messages — inspecting, editing, replaying, transforming, and automating, all without a terminal and without broker credentials ever leaving the server.

Before you start

  • 1.Open Triage in any modern browser at the URL your administrator gave you. There’s nothing to install on your machine.
  • 2.Sign in with your username and password, or via your organisation’s SSO (GitHub, Google, or OIDC).
  • 3.What you can do depends on your role. If a button is missing, you likely have a more restricted role — ask an admin.

Roles at a glance

Triage uses role-based access control. Your role determines which of the actions in this guide are available to you. Viewer, Operator, and Admin nest, each taking in the one before it; Developer sits to one side of that ladder — it authors transform scripts and does nothing else, so if it’s your role, most of this guide won’t apply to you.

Viewer
Can
Browse queues, inspect messages, view attributes and receive history, read the audit log and traces.
Can’t
Edit, replay, run transforms, or change any configuration.
Typically
Support engineers and auditors who need to see a message without touching it.
Operator
Can
Everything a Viewer can, plus edit payloads, replay individually or in bulk, apply any saved transform to a replay, and manage replay rules and alerts.
Can’t
Author transforms (that is Developer or Admin), or manage users, roles, providers, API tokens, or instance configuration.
Typically
The day-to-day on-call and engineering staff who actually work the DLQ.
Developer
Can
Author transforms: write, test, clone, and version scripts, and see which replay rules use them. Delete one you last authored.
Can’t
Everything else — replay, edit or peek at messages, read the replay log or traces, and any configuration. Not a step up from Viewer: real message payloads are closed to it, so scripts are tested against samples you paste in.
Typically
Application engineers who own the fix for a failure but not the queue it happens on. Triage shows them the Transforms page and nothing else.
Admin
Can
Full operator capability plus transform authorship, user management, role assignment, provider and storage configuration, API tokens, and the Architecture export.
Can’t
—
Typically
Platform owners responsible for running the Triage instance itself.
Service account
Can
Non-interactive access via a scoped API token — used by CI pipelines and automation to drive Triage programmatically.
Can’t
Log in interactively; scope is set by the token issued to it.
Typically
Automated integrations, not people.

Finding your way around

The main areas of Triage, and what each one is for.

Dashboard

Real-time queue metrics, a 21-day replay history chart, firing alert rules, and — when federation is configured — the status of every peer instance. Your starting point each shift.

Queues

Every queue Triage can see in your provider, with live depth. For Anypoint MQ, DLQs are identified from their real configuration and each shows the source queues that feed it. Click any queue to drill into its messages.

Messages

The message list for a queue. Peek non-destructively, filter by content, search body text, and open any message for the full payload, attributes, receive count, and timestamps.

Storage

When a storage provider is configured, browse a GCS, Azure Blob, or S3-compatible bucket — AWS S3, Cloudflare R2, Wasabi, Backblaze B2, DigitalOcean Spaces, or MinIO — of rejected "poison" objects with the same inspect → edit → replay workflow you use for queues.

Transforms

Author, test, and save reusable JavaScript transforms that clean, reroute, or reject messages.

Replay rules

Define and monitor scheduled rules that match queues by glob pattern and replay matching messages automatically.

Alerts

Set queue-depth thresholds with business-context labels and choose where breaches are delivered. View depth history and the alert event timeline per queue.

Audit log

The immutable record of every edit, replay, transform application, and routing decision — filterable, paginated, and exportable to CSV.

Architecture

A searchable list and layered topology diagram of the running instance and its federation peers, with a time-limited read-only share link for incidents.

Read-only · safe

Inspect a failed message

  1. 1

    Open Queues and pick the DLQ you’re investigating — depth is shown next to each.

  2. 2

    Triage peeks messages: they stay on the queue and are never consumed. On Anypoint MQ a peek takes a short peek-lock and the message returns automatically if you don’t act on it.

  3. 3

    Click a message to open it. You get the full payload with syntax-highlighted JSON/XML, all attributes and headers, the receive count, and timestamps.

  4. 4

    Use content filter and body-text search to narrow a large DLQ to just the messages you care about.

Operator

Edit and replay

  1. 1

    Open a message and switch to the editor. The structured editor shows a live diff of your changes against the original body.

  2. 2

    Choose a destination — the original source queue, or any other queue (including a queue on another provider when federation is configured).

  3. 3

    Replay one message, or select many from the list and bulk-replay them in a single action.

  4. 4

    Every replay is written to the audit log: who did it, what changed, the source and destination, and the before/after payload.

Developer or Admin

Write a JavaScript transform

  1. 1

    Open Transforms and create a new script. A transform receives a message and can modify the payload and its attributes, reroute it to a different destination, or abort on a condition you define.

  2. 2

    Test it in the browser before anything touches production traffic — the live panel shows the full output, including the attributes going out. An admin can load a real message from a queue to test against; a developer pastes in a sample instead, since real payloads are outside that role.

  3. 3

    Save it. Every save that changes the name, description, or script writes a version, so you can review the history or clone an earlier one.

  4. 4

    Then apply it when replaying: individually, across a bulk selection, or attached to an automated replay rule — that part is an operator or admin action.

  5. 5

    Two guards protect live traffic. Once an enabled replay rule references a transform, a developer can no longer edit it in place — clone it, edit the copy, and have an admin promote it. And deleting a transform, which discards its version history too, is limited to the one you last authored unless you’re an admin.

  6. 6

    Transforms are reusable — write the fix once and apply it everywhere the same failure shows up.

Operator

Automate with replay rules

  1. 1

    Open Replay rules and create a rule. Match queues by glob pattern (*-dlq, orders-*) and filter messages by JSON path or body regex.

  2. 2

    Attach an optional transform to adjust each message before it’s re-injected.

  3. 3

    Set a cron schedule — e.g. every 15 minutes — and, with federation, route matched messages to a queue on another provider.

  4. 4

    Always run a dry-run first: it shows exactly which messages would move, and where, without moving anything. Then enable the rule and let it drain the DLQ unattended.

Optional · your LLM key

Diagnose with AI

  1. 1

    If your admin has enabled AI diagnosis, every message shows a Diagnose button.

  2. 2

    Triage sends the payload, queue name, attributes, and sibling-message context to your configured LLM provider (Anthropic, OpenAI, or any compatible model) using your own API key.

  3. 3

    You get back a structured result: probable cause, the affected fields, and suggested remediation steps.

  4. 4

    No message data goes to any Triage-operated endpoint — the call runs from your network straight to your provider, billed to your account.

Operator

Remediate a poison object in storage

  1. 1

    Open Storage. If more than one bucket is configured, pick one from the Bucket selector in the header — any bucket Triage currently can’t reach is flagged amber there, and the rest still work.

  2. 2

    Find the object: walk the prefixes using the breadcrumb, or search by key. Deep buckets load a page at a time, so the count reads N+ shown until you’ve pressed Load more through to all loaded.

  3. 3

    Click an object to open it. Above the body you get its size, last-modified time, content type, storage class, any custom metadata, and — in blue — the x-triage-* attributes carried over from the message that produced it. Those are what tie an object in a bucket back to the failure behind it.

  4. 4

    To change it you need Operator or Admin; a Viewer sees the same object read-only. Edit the body in place and work across the pipeline tabs — Original → Edit → Transform → Diff — to apply a saved transform and read the exact diff before you commit. If the transform is erroring, Save and Replay both stay disabled, so nothing half-transformed can leave.

  5. 5

    Save writes the corrected object back to the same key. Replay to queue sends it to a processing queue instead — or Replay to instance, when federation is configured, to a peer. Either way the object stays in the bucket; replaying doesn’t consume it.

  6. 6

    Rename / move takes a new key and, with several buckets configured, a different destination bucket — including one on another provider. It copies server-side without loading the body, so it works on binary objects and on ones too large to open inline. If something already sits at the target key you get an explicit Overwrite confirm, and that one is permanent.

  7. 7

    Delete is a soft delete: the object moves to the bucket’s trash prefix and can be restored from Storage Events until your bucket’s lifecycle rule reaps it. Storage Events is the log of every storage action, and it captures the original body — so you can also roll back a bad edit, not just an accidental delete.

Staying on top of it

Beyond fixing individual messages — how Triage keeps you informed, auditable, and oriented.

Alerts & notifications

Queue-depth thresholds fire to Slack, PagerDuty, email, webhooks, AWS SNS, or OpenTelemetry when a queue breaches — and again on recovery. Replay-rule failures alert on exceptions only (one notification per run), so a background rule that quietly breaks doesn’t stay silent. Depth-history charts and an alert event timeline live on each queue.

Message tracing

Every replayed message is stamped with a correlation ID. The trace timeline reconstructs a message’s full journey — across providers, storage actions, and federated instances — in chronological order. Triage also emits OpenTelemetry spans and propagates the W3C traceparent header, so a replay stays on the same trace in Datadog, Grafana, or Honeycomb.

Audit log

Every replay, transform application, and routing decision is recorded with actor, timestamp, source queue, destination, and the original and modified payload. Filter by date range and export to CSV — the evidence a SOX, HIPAA, or PCI-DSS review asks for, produced in minutes.

Ask an AI agent (MCP)

Triage exposes a read-only Model Context Protocol endpoint, so you can point any MCP client at your instance with your own API token and ask questions in plain language: which queues are filling, when a depth climb started, why messages are being dead-lettered, and whether they have already been retried. If your instances are federated, the agent can also describe the whole estate from one endpoint — every peer, its broker, and its health — and, with an operator or admin token, compare live peer workloads to see which instance a backlog is actually on and whether a cross-instance replay target exists, without connecting to each one. An operator or admin token also reaches archived messages: which storage buckets exist, what has been written to them, what has already been republished or deleted, and — from an object's archived trace attributes — the full journey of the message it came from, so an object found in a bucket can be tied back to the failure behind it. The agent inherits your role and can only read: it cannot replay, purge, or peek at messages still sitting in a queue, and no tool ever returns a message body or the contents of an archived object. Ask an admin for a scoped token and the endpoint URL.

Architecture view

During a break-fix, open the Architecture view for a layered diagram of what this instance talks to — its queue provider, storage backend, shared Postgres/Redis, and federation mesh with shared-failure domains. Generate a read-only share link for the incident channel so everyone sees the same live picture.

Running the instance, not just using it?

Deployment, configuration, licensing, RBAC, federation, retention, and encryption are covered in the administrative guide.

Administrative guide →