From Logfiles to Slack: How I Automated Our Daily Error Digest

Description and use

Automating daily error collection from CloudWatch and a staging server with n8n and sending a digest to Slack saves 30‑45 minutes and reduces missed critical errors.

Problem

Daily manual inspection of production and staging error logs consumed 30‑45 minutes each morning and risked missing critical issues.

Outcome

The automated flow saves 30‑45 minutes daily, reduces missed critical errors, and delivers concise error digests to Slack.

Workflow

• Schedule Trigger at 8:30 AM EST
• CloudWatch Logs Node with filterPattern { $.level = "ERROR" || $.level = "FATAL" } and jsonPath $json.logEvents[*].message
• SSH Command Node on staging running grep -E 'ERROR|FATAL' /var/log/app.log | tail -n 50
• Item Lists nodes transform CloudWatch and SSH outputs into readable lists
• Merge node combines lists
• Code node deduplicates and formats into Markdown, filtering benign "User session expired" if sole entry
• Slack Node posts formatted string to #dev-alerts, or “All clear!” if no new errors

Evidence

It probably ate up 30-45 minutes every single morning by the time I'd consolidated it into something resembling awareness.

Source

I configured it to connect to our AWS account, pulling logs from specific log groups for the past 24 hours.

Source

Finally, this node takes the formatted string and sends it to a dedicated #dev-alerts Slack channel.

Source