Bring OpenObserve into your n8n workflows. Send structured logs, query logs and metrics, manage dashboards and alerts, and start a workflow when a selected alert fires.
Published on npm · v0.1.3MIT-licensed project codeIndependent community integration
Send one structured log object or ingest all input-item JSON objects as a batch. Use SQL for search and PromQL for metric queries. Continuous metric collection belongs in a collector such as Prometheus or OpenTelemetry; this package does not expose metric ingestion.
Manage stream settings, VRL functions, dashboards, alert templates, webhook destinations, alerts, and real-time or scheduled pipelines. Destructive actions and manual alert triggering require confirmation in the node. Explicit stream provisioning, panel CRUD, and Enterprise-only Service Graph are not exposed.
Search supports Return All for normalized JSON rows; raw and formatted output are single-response modes. Pipeline definitions use structured JSON. Add an explicit default route when unmatched real-time events must be retained.
Supported resources and operations
Resource
Operations
Stream
Delete, Delete Fields, Get Many, Get Schema, Update Settings
Log
Ingest, Ingest Many
Search
Get Field Values, Query, Search Around
Metric
Find Series, Get Label Values, Get Labels, Get Metadata, Instant Query, Range Query
Trace
Get DAG, Get Latest
Function
Create, Delete, Get Dependencies, Get Many, Update, Validate VRL
Dashboard
Create, Delete, Get, Get Many, Update
Alert Template
Create, Delete, Get, Get Many, Get Prebuilt, Update
Alert Destination
Create, Delete, Get, Get Many, Update
Alert
Clone, Create, Delete, Disable, Enable, Export, Get, Get History, Get Many, Trigger Manually, Update
Pipeline
Create, Delete, Disable, Enable, Get, Get History, Get Many, Update
Trigger setup
OpenObserve Trigger receives Alert Triggered events for explicitly selected alerts. It creates its own template and webhook destination, attaches that destination to the selected alerts, and validates a separate random delivery secret. Deactivation removes only its owned attachments and artifacts. Repeated deliveries can create duplicate executions; make downstream effects idempotent or add deduplication.
Reviewed 2026-09-06 against release source da96742. See the repository for tests and detailed limitations.
Create sustained capacity review tasks from OpenObserve metrics to Twenty CRM
This workflow checks Prometheus-style infrastructure metrics in OpenObserve on a schedule, detects sustained pressure based on coverage and threshold rules, and then creates or updates a matching review task in Twenty CRM with evidence from the latest and previous time windows.
Workflow preview unavailable.You can still inspect this template on n8n.
Interactive n8n workflow
Enrich OpenObserve alerts with log context and notify responders via Novu
This workflow triggers on selected OpenObserve alerts, queries nearby logs for context, redacts sensitive fields, suppresses duplicate notifications with a cooldown, and sends an enriched incident payload to Novu responders (or outputs a preview) while recording notification state in an n8n Data Table.
