n8n
Receive workflow automation logs from n8n showing workflow executions, node activities, and automation events.
Ingest Methods
RunReveal offers the following ways to ingest n8n logs:
Webhook
n8n can send logs directly to RunReveal via webhook.
Step 1: Create Webhook Source in RunReveal
- Go to Sources in RunReveal
- Click the n8n source tile (or n8n Webhook if available)
- Give it a descriptive name (e.g., “n8n Webhook”)
- Optionally enable bearer token authentication for added security
- Click Connect Source to generate a unique webhook URL
- Copy the generated webhook URL and bearer token (if enabled)
Step 2: Configure n8n
- Log into your n8n console
- Navigate to integrations or webhook settings
- Add a new webhook destination
- Configure the webhook:
- URL: Paste the RunReveal webhook URL you copied
- Method: POST
- Content-Type: application/json
- Authorization: If you enabled bearer token, add
Authorization: Bearer YOUR_TOKENheader
- Save the webhook configuration
Schema
The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.
Table: n8n_logs (44 columns)
n8n_logs (44 columns)| Column | Type |
|---|---|
workspaceID | String |
sourceID | String |
sourceType | LowCardinality(String) |
sourceTTL | UInt32 |
receivedAt | DateTime |
id | String |
eventTime | DateTime |
eventName | String |
eventID | String |
srcIP | String |
srcASCountryCode | String |
srcASNumber | UInt32 |
srcASOrganization | String |
srcCity | String |
srcConnectionType | String |
srcISP | String |
srcLatitude | Float64 |
srcLongitude | Float64 |
srcUserType | String |
dstIP | String |
dstASCountryCode | String |
dstASNumber | UInt32 |
| Column | Type |
|---|---|
dstASOrganization | String |
dstCity | String |
dstConnectionType | String |
dstISP | String |
dstLatitude | Float64 |
dstLongitude | Float64 |
dstUserType | String |
actor | Map(String, String) |
tags | Map(String, String) |
resources | Array(String) |
serviceName | String |
enrichments | Array(Tuple(data Map(String, String), name String, provider String, type String, value String)) |
readOnly | Bool |
rawLog | String |
n8nEventId | String |
message | String |
workflowId | String |
workflowName | String |
executionId | String |
nodeType | String |
nodeName | String |
nodeId | String |