Automated Elasticsearch Alert Email System

This n8n workflow automates the process of retrieving alerts from an Elasticsearch system and sending email notifications when new alerts are detected. Designed for continuous monitoring, it ensures that critical alerts are promptly communicated via email, improving incident response times.

The workflow begins with a scheduled trigger that periodically initiates the process. It then sends an HTTP GET request to a specified Elasticsearch API endpoint to fetch the latest alerts. The retrieved data is checked for emptiness; if no alerts are present, the workflow terminates gracefully. If alerts are found, it loops through each alert item.

For each alert, an email notification is constructed and sent via Microsoft Graph API using OAuth2 authentication. The email includes details such as alert name, severity, timestamp, and additional message content. Once all alerts are processed, the workflow completes.

This setup is highly useful in IT monitoring environments where timely notification of Elasticsearch alerts—such as system errors, security breaches, or performance issues—is critical for maintaining system health and security.