Linking Sonar (SonarSource) - SonarQube Server as a source
Let AI connect your sources for you
Skip the manual setup — run this in your project and the wizard auto-detects your databases and APIs and connects them to PostHog.
Contents
The Sonar (SonarSource) - SonarQube Server connector syncs code-quality data into the PostHog data warehouse – projects, their analyses, branches, and pull requests, metric definitions and values, metric history, quality gates and their status per project, coding rules, issues and their change history, security hotspots, and users – so you can trend technical debt, reliability, coverage, and issue counts alongside your product data.
Prerequisites
Credentials that can read the data you want to sync. PostHog only reads data, so read access is enough.
Adding a data source
- In PostHog, go to the Sources tab of the data pipeline section.
- Click + New source and click Link next to this source.
- Enter your credentials (see Configuration below) and click Next.
- Select the tables you want to sync, choose a sync method and frequency, then click Import.
Once the syncs are complete, you can start querying this data in PostHog.
Connect your self-hosted SonarQube Server to pull code-quality data.
Using SonarQube Cloud (sonarcloud.io or sonarqube.us)? Connect it with the Sonar Cloud source instead.
Enter your server URL (e.g. https://sonarqube.yourcompany.com) and a user token. Create a token under My Account → Security → Generate Tokens in your SonarQube instance. The token inherits your permissions, so it can read the projects, issues, and rules you can see. Syncing the users table additionally requires the Administer System permission.
You'll be asked for:
- Server URL: for example
https://sonarqube.yourcompany.com. - User token
Sync modes
Each table can be synced in one of several modes, depending on what the source supports:
- Webhook (when available) – the source pushes changes to PostHog in real time. Fastest freshness, lowest ongoing cost, and the only mode that reliably captures updates and deletes.
- Incremental – only new or updated rows are synced on each run, using a cursor field (such as an
updated_attimestamp). Cheaper than a full refresh, but deletes aren't captured. - Append only – new rows are appended using a cursor field; existing rows are never updated. Ideal for immutable, append-only tables like event logs.
- Full refresh – the whole table is reloaded on every sync. Use it when a table has no reliable cursor or when you need deletions reflected.
See sync methods for a full explanation of how each mode works and how to choose between them.
Issues support incremental sync: after the first run, only issues created since the last sync are fetched (using the createdAfter filter on the issue creation date). Because SonarQube has no "updated since" filter for issues, status changes on existing issues (e.g. an issue being resolved) are only picked up on a full refresh. Measures history also syncs incrementally: after the first run, only analyses from a day before the last synced date onward are fetched (using the from filter). The overlap catches analyses that the server finished processing after the last sync. Project analyses sync incrementally the same way, on the analysis date. All other tables sync with a full refresh each run.
Component measures holds one row per metric for every project, directory, and file, so it can grow large on big codebases. It's off by default; turn it on when you need file-level values. For project-level trends, use measures history.
Issue changelog needs one request per issue because SonarQube returns one issue's history at a time. On instances with many issues, a sync takes a long time. It's off by default.
Project pull requests only has data on Developer Edition and above. Community Build doesn't analyze pull requests, so this table stays empty there.
Users requires the Administer System permission. It's off by default.
Hotspots use an API that SonarQube Server 2026.4 deprecated in favor of security issues. On those versions, security findings also appear in the issues table.
Configuration
| Option | Type | Required |
|---|---|---|
Server URL | text | Yes |
User token | password | Yes |
Supported tables
| Table | Description | Sync method | Incremental field | Primary key |
|---|---|---|---|---|
projects | Projects analyzed on your SonarQube instance (components with the TRK qualifier). | Full refresh | — | — |
metrics | Definitions of the metrics SonarQube can measure (e.g. coverage, bugs, code smells). | Full refresh | — | — |
rules | The catalog of coding rules used to raise issues during analysis. | Full refresh | — | — |
issues | Issues raised by analysis — bugs, vulnerabilities, code smells, and security hotspots. | Incremental, Full refresh | creationDate | — |
quality_gates | Quality gates defined on the instance: the sets of conditions a project must meet to pass. | Full refresh | — | — |
project_quality_gate_status | Current quality gate result of each project's main branch, with the result of each condition. | Full refresh | — | — |
hotspots | Security hotspots: security-sensitive code that needs a manual review. Deprecated in SonarQube 2026.4 in favor of security issues. | Full refresh | — | — |
component_measures | Current value of each metric on each component (project, directory, file) of each project's main branch, one row per component and metric. | Full refresh | — | — |
measures_history | Value of each metric at each analysis of each project's main branch, one row per project, metric, and analysis date. | Incremental, Full refresh | date | — |
project_analyses | Analyses of each project's main branch, with the version and the events (quality gate changes, version markers, quality profile changes) attached to each one. | Incremental, Full refresh | date | — |
project_branches | Branches of each project, with the quality gate status of their last analysis. | Full refresh | — | — |
project_pull_requests | Pull requests analyzed in each project, with the quality gate status of their last analysis. Developer Edition and above only. | Full refresh | — | — |
issue_changelog | Change history of each issue (status, resolution, assignee, severity, and other field changes), one row per change. | Full refresh | — | — |
users | Users of the SonarQube instance. Requires the Administer System permission. | Full refresh | — | — |
Troubleshooting
- If the connection fails with an authorization error, the user token is wrong, expired, or has been revoked. Create a new one, then reconnect the source.
- If a table syncs no rows, the credential may not have access to that data. Check its permissions, then reconnect the source.
- If the users table fails to sync, the token's user needs the Administer System permission. Either grant it or leave the users table unselected.
- If you see fewer issues than expected on a large project, note that SonarQube caps issue search at 10,000 results per query window. PostHog automatically pages past this by re-windowing on the issue creation date, so all issues are synced. If you still see gaps, check that the token can browse the affected projects.
- If the project_pull_requests table is empty, this table only has data on Developer Edition and above. Community Build doesn't analyze pull requests.
- If you see fewer hotspots than expected on a large project, note that SonarQube caps hotspot search at 10,000 results per project. PostHog can't page past this limit, so projects with more hotspots have incomplete hotspot data.
If your sync is failing or data looks wrong, see the Data warehouse troubleshooting guide. If that doesn't help, contact support – we're happy to help.