# ISS-0043: Expensive Query 告警应优先查 TiDB slow query 日志

## Background

In workspace `lark-ws-a7da5d80-9dce-456b-b947-627f49eb03df` (O11Y-2426677), the alert was "expensive query" (100+ queries > 60s in 1 min). Agent used TopSQL TiKV as the primary data source to find the problem SQL, which happened to work in this case but is not the correct diagnostic path.

User feedback: "expensive query 是要找 tidb 对应日志的，并且去掉 analyze 相关 query"

The correct approach for expensive query alerts:
1. Query TiDB slow_query logs filtered by `query_time > threshold` (the alert's threshold, typically 60s)
2. Filter out ANALYZE-related queries (internal operations, not user workload)
3. Group by SQL digest to find the top expensive patterns
4. Then correlate with TopSQL/metrics for deeper analysis

## Root Cause

SKILL.md Node C does not have alert-type-specific routing for "expensive query" alerts. The agent falls into the generic TopSQL/metrics path, which misses the most direct evidence source (slow_query logs with duration filter).

## Fix Plan

### Step 1: Add alert-type routing to SKILL.md Node C

```markdown
### Alert-Type-Specific Routing (Node C)

Before generic analysis, check the alert type and route accordingly:

**Expensive Query / Slow Query alerts:**
1. FIRST: Query TiDB slow_query logs with `query_time > {alert_threshold}s`
   - Group by `digest_text`, order by `count(*)` DESC
   - Filter out internal queries: WHERE digest_text NOT LIKE '%ANALYZE%' AND digest_text NOT LIKE '%information_schema%'
2. For each top expensive SQL:
   - Get execution plan (decoded_plan)
   - Check actRows vs estRows divergence
   - Identify missing indexes or suboptimal plan choices
3. THEN: Correlate with TopSQL/metrics for node-level impact (which TiKV nodes are hot)
```

### Step 2: Add ANALYZE filter to collect_evidence.py

When querying slow_query logs, add a filter to exclude ANALYZE-related queries:

```python
# In slow_query extraction
WHERE digest_text NOT LIKE '%ANALYZE%'
  AND digest_text NOT LIKE '%information_schema%'
  AND digest_text NOT LIKE '%mysql.stats%'
```

### Step 3: Verification

1. Replay O11Y-2426677: agent should first query slow_query logs, find the expensive SELECT on dh_account_basic, and exclude any ANALYZE queries
2. The agent should still arrive at the same root cause (missing index) but via the correct diagnostic path