Back to Projects
Real-Time AutomationLiveBuilt on n8n

Event-Driven Alert Pipeline

Turning long-form generated reports into clean, de-duplicated alerts in about two seconds

Project Snapshot
Event-Driven Alert Pipeline

Overview

A research routine writes long-form reports to disk several times a day, and each one buries a handful of actionable items inside thousands of words of prose. Reading them end to end is the part nobody keeps doing. This pipeline watches the folder instead. The moment a report lands it extracts every qualifying item, decides whether that item is genuinely new, a material change to something already sent, or a repeat worth suppressing, and delivers the survivors as structured alerts with the relevant chart attached.

Approach & Architecture

A file watcher fires on write rather than on a polling interval, so an alert lands about two seconds after a report is saved. A parser locates the relevant sections and splits them per item, using layered fallbacks for every field because the source formatting drifted repeatedly over months. Each field then passes a single redaction gate before it can be shipped. A three-layer dedup, combining a short burst guard, a per-item content fingerprint, and a rolling history, classifies each item, and the renderer builds the message and resolves a matching chart before delivery.

Workflow Topology

WATCHPARSEDEDUPRENDERDELIVERfresh/changedrepeatrecords sentFile Watcher — Fires on write, roughly two seconds after a file landsFile WatcherSource Map — Folder resolves to a default item typeSource MapSplit Sections — Locates the relevant sections and splits them per itemSplit SectionsExtract Fields — Layered fallbacks across three drifting document formatsExtract FieldsPrivacy Scrub — Every outbound field passes a single redaction gatePrivacy ScrubFingerprint — Burst guard plus a per-item content fingerprintFingerprintRolling History — Classifies each item fresh, changed, or suppressedRolling HistoryBuild Embed — Colour-coded, plan first and management guidance lastBuild EmbedAttach Chart — Type-aware lookup resolves the matching imageAttach ChartPost Alert — Branches to a multipart or plain payloadPost AlertSuppress — Most runs resolve here, which is what keeps the channel readableSuppress2 workflows · 16 nodes · File watcher, Schedulen8n

A condensed view of the real node graph.

Outcome & Impact

Nearly a thousand unattended production runs with a single failure, over roughly three months. Alert latency fell from a five-minute polling window to about two seconds. Most runs deliberately resolve to suppression, which is the point: the dedup layers are what keep the destination readable rather than noisy.

Challenges & Solutions

  • Deduplicating event bursts from a polling file watcher, where an atomic save emits several events for what is logically one write
  • Parsing free-form generated prose whose formatting drifted over months, which forced layered fallbacks on nearly every extracted field
  • Guaranteeing nothing sensitive reaches a shared destination by gating every outbound field through one redaction pass rather than filtering the finished message
  • Keeping durable dedup state with no extra infrastructure, using the workflow's own static store with time-based pruning and bounded key sets

Key Features

  • Event-driven watcher delivers alerts about two seconds after a report lands, replacing a five-minute polling design
  • Three-layer deduplication classifies every item as new, changed, or suppressed, with a readable change summary on updates
  • Redaction gate applied per field rather than per message, so alerts are safe to post in a shared destination
  • Format-tolerant parser handles three distinct report layouts with layered per-field fallbacks
  • Type-aware attachment resolves each item to its matching chart and branches the delivery payload accordingly
  • Structured messages colour-coded by type and direction, leading with the plan and closing with the caveats
  • Chat-ops listener parses commands with key-value arguments and authorises a single configured user

Tech Stack

n8nJavaScriptNode.jsMarkdownDiscord APIDocker

Automation

Platform
n8n
Workflows
2
Nodes
16
Triggers
File watcher, Schedule
Alert Pipeline
Watches for new reports, extracts and de-duplicates items, and delivers the survivors
Command Listener
Chat-ops front end that runs a pipeline on demand and replies with the result

Tags

AutomationEvent-DrivenDeduplicationAlertingData PipelineRegex Parsing

Status

Live