AI alert grouping and incident summaries n8n template

What this workflow does

1. Alert intake (Webhook) is the single endpoint for every alert source.
2. Normalize and group alerts (Code) converts SNS CloudWatch alarms, Azure Monitor common alert schema, Google Cloud incidents and generic JSON into one shape. It fingerprints each alert by service, environment and title with numbers stripped, and suppresses repeats inside a 10-minute window using workflow static data. Resolved and informational alerts are dropped.
3. Route by severity (Switch) sends critical groups to be summarized, warnings to the digest sheet, and SNS subscription confirmations to the ops channel.
4. CloudWatch: recent error logs (HTTP Request, signed with your AWS credential) runs a bounded FilterLogEvents call on the service’s log group for the alert window.
5. GitHub: recent commits (HTTP Request) lists commits from the last six hours in the service’s repo.
6. Redact and build prompt (Code) masks AWS keys, tokens, JWTs, passwords, emails, IP addresses and card-like numbers, counts the top error signatures, caps the sample at about 6 KB and builds a structured-output request.
7. Claude: summarize incident (HTTP Request) returns a headline, impact, start time, scale, recent changes, at most two labeled hypotheses and the unknowns. The system prompt forbids recommending destructive actions.
8. Format Slack summary (Code) handles refusal, max_tokens and API errors. If the summary fails, it posts the raw alert instead, so on-call never gets nothing.
9. Slack: post to on-call delivers it. Google Sheets: daily digest log records warnings.

Before you import

• n8n 1.x. Self-hosting inside your cloud account keeps log data in your environment.
• An AWS IAM user or role limited to logs:FilterLogEvents, added as n8n’s AWS credential.
• A read-only GitHub token, an Anthropic API key, a Slack app with chat:write, and a Google Sheet with an “Alert digest” tab.

Setup

1. Edit SERVICES in Normalize and group alerts so each service name maps to its log group and repo. Adjust WINDOW_MINUTES.
2. Replace REPLACE_WITH_AWS_REGION, REPLACE_WITH_DEFAULT_LOG_GROUP, REPLACE_WITH_GITHUB_OWNER and REPLACE_WITH_DEFAULT_REPO.
3. Set REPLACE_WITH_ONCALL_CHANNEL_ID, REPLACE_WITH_OPS_CHANNEL_ID and REPLACE_WITH_DIGEST_SHEET_ID. Add the column headers shown on the Sheets node.
4. Activate the workflow, then point SNS, Azure action groups and Google Cloud notification channels at the production webhook URL. Open the SNS confirmation link when it appears in the ops channel.

Test it

POST a generic alert such as {"service":"web","severity":"critical","title":"5xx rate above 5%"} and check the Slack summary. Send it again within ten minutes and confirm nothing new is posted. Run the redaction step against a real log sample that contains a token and an email, and check nothing slipped through.

Make it production-ready

• Grouping state only persists in an active workflow. Move it to Redis or Postgres if you run several n8n workers.
• Add a scheduled digest workflow that reads the sheet each morning and posts counts and trends.
• Protect the webhook with header authentication where the source supports it.
• Cap log bytes, not only rows, and keep the IAM policy narrow.
• Use claude-haiku-5-5 for routine groups and keep the stronger model for critical incidents. See Claude API for model notes.

Read the full guide at How to summarize logs and alerts with AI, or talk to us about wiring in Azure and Google Cloud log queries.