Alertmanager to Slack & PagerDuty with GPT-4.1 RCA n8n

Turn Prometheus Alertmanager alerts into actionable Slack + PagerDuty notifications—powered by GPT-4.1 RCA

This n8n automation workflow receives Alertmanager webhooks, deduplicates and rate-limits incidents in Postgres, generates a GPT-4.1 RCA (Root Cause Analysis) using an OpenAI tool-calling agent, and routes tiered notifications to Slack (plus Email and PagerDuty for high/critical or flapping events). It also creates or updates ClickUp incident tickets and logs pipeline health.

What this workflow does

• Receives Alertmanager webhooks for both firing and resolved alerts.
• Normalizes key fields (fingerprint, severity, source, and affected service) and closes the related incident in Postgres, notifying Slack immediately when resolved.
• Suppresses alert storms by checking Postgres for existing open incidents, applying a cooldown window, while still incrementing an occurrence counter.
• Classifies the alert (client-side vs backend-side) and runs a GPT-4.1 RCA agent that can query client telemetry APIs, Prometheus metrics, recent deployments, and a vector search of past incidents.
• Validates structured JSON output from the agent; malformed results are sent to a dead-letter path for logging and investigation.
• Upserts incident records in Postgres, applies an escalation policy, sends Slack plus Email and PagerDuty when appropriate, and creates/comments on ClickUp tickets.
• Logs execution health to Postgres and returns a JSON response to the webhook caller.

Use cases

• Reduce noisy Alertmanager pages by deduplicating and rate-limiting incidents.
• Provide engineers with fast, structured RCA summaries in Slack using GPT-4.1.
• Escalate only high/critical (or flapping) alerts to PagerDuty and track everything in ClickUp.

Technical details

• n8n nodes/integrations: if, set, switch, webhook, Slack, ClickUp, Postgres.
• OpenAI tool-calling RCA agent with GPT-4.1, JSON validation, and dead-letter handling.
• Routes tiered notifications to Slack, and for high/critical or flapping alerts to Email and PagerDuty.