Enrich OpenObserve Alerts with Log Context & Notify via Novu

Enrich OpenObserve Alerts with Log Context and send smarter notifications via Novu

This n8n workflow listens for selected OpenObserve alerts, automatically pulls nearby log evidence for context, redacts sensitive fields, suppresses duplicate notifications during a cooldown, and then delivers an enriched incident payload to Novu responders (or outputs a preview).

What this workflow does

• Triggers on OpenObserve alerts and receives the alert payload through the OpenObserve trigger.
• Normalizes and validates key fields such as alert ID/name, service, severity, and timestamp, then derives a stable incident key.
• Queries surrounding logs using a bounded OpenObserve SQL query for the configured log stream and service field, searching around the alert time window.
• Selects the closest log record and, when found, uses OpenObserve “Search Around” to retrieve additional surrounding context.
• Builds an incident brief by limiting evidence size and redacting common secret-like fields, then prepares a Novu payload and an idempotent notification key.
• Suppresses duplicates with cooldown by checking an n8n Data Table for prior notification state; alerts are suppressed unless severity increases.
• Notifies via Novu (or returns a preview payload in preview mode) and then upserts cooldown state back to the n8n Data Table.

Use cases

• When OpenObserve fires an alert, give responders immediate log-backed context without manually searching dashboards.
• Reduce alert fatigue by preventing repeated notifications during an incident cooldown period.
• Prepare a clean, responder-ready incident payload by redacting sensitive fields before sending to notifications.

Technical details

• Integrations: OpenObserve (alerts + log search) and Novu (incident/notification delivery).
• n8n nodes/logic: if, set, code, data table, and the blackswampain8n-nodes-novunovu Novu node.
• State management: stores notification state and cooldown timestamps in an n8n Data Table for idempotent behavior.