Event-Driven Alert Pipeline
Turning long-form generated reports into clean, de-duplicated alerts in about two seconds

Overview
A research routine writes long-form reports to disk several times a day, and each one buries a handful of actionable items inside thousands of words of prose. Reading them end to end is the part nobody keeps doing. This pipeline watches the folder instead. The moment a report lands it extracts every qualifying item, decides whether that item is genuinely new, a material change to something already sent, or a repeat worth suppressing, and delivers the survivors as structured alerts with the relevant chart attached.
Approach & Architecture
A file watcher fires on write rather than on a polling interval, so an alert lands about two seconds after a report is saved. A parser locates the relevant sections and splits them per item, using layered fallbacks for every field because the source formatting drifted repeatedly over months. Each field then passes a single redaction gate before it can be shipped. A three-layer dedup, combining a short burst guard, a per-item content fingerprint, and a rolling history, classifies each item, and the renderer builds the message and resolves a matching chart before delivery.
Workflow Topology
A condensed view of the real node graph.
Outcome & Impact
Nearly a thousand unattended production runs with a single failure, over roughly three months. Alert latency fell from a five-minute polling window to about two seconds. Most runs deliberately resolve to suppression, which is the point: the dedup layers are what keep the destination readable rather than noisy.
Challenges & Solutions
- Deduplicating event bursts from a polling file watcher, where an atomic save emits several events for what is logically one write
- Parsing free-form generated prose whose formatting drifted over months, which forced layered fallbacks on nearly every extracted field
- Guaranteeing nothing sensitive reaches a shared destination by gating every outbound field through one redaction pass rather than filtering the finished message
- Keeping durable dedup state with no extra infrastructure, using the workflow's own static store with time-based pruning and bounded key sets
Key Features
- Event-driven watcher delivers alerts about two seconds after a report lands, replacing a five-minute polling design
- Three-layer deduplication classifies every item as new, changed, or suppressed, with a readable change summary on updates
- Redaction gate applied per field rather than per message, so alerts are safe to post in a shared destination
- Format-tolerant parser handles three distinct report layouts with layered per-field fallbacks
- Type-aware attachment resolves each item to its matching chart and branches the delivery payload accordingly
- Structured messages colour-coded by type and direction, leading with the plan and closing with the caveats
- Chat-ops listener parses commands with key-value arguments and authorises a single configured user
Tech Stack
Automation
- Platform
- n8n
- Workflows
- 2
- Nodes
- 16
- Triggers
- File watcher, Schedule