n8n

Receive workflow automation logs from n8n showing workflow executions, node activities, and automation events.

Ingest Methods

RunReveal offers the following ways to ingest n8n logs:

Webhook

n8n can send logs directly to RunReveal via webhook.

Step 1: Create Webhook Source in RunReveal

  1. Go to Sources in RunReveal
  2. Click the n8n source tile (or n8n Webhook if available)
  3. Give it a descriptive name (e.g., “n8n Webhook”)
  4. Optionally enable bearer token authentication for added security
  5. Click Connect Source to generate a unique webhook URL
  6. Copy the generated webhook URL and bearer token (if enabled)

Step 2: Configure n8n

  1. Log into your n8n console
  2. Navigate to integrations or webhook settings
  3. Add a new webhook destination
  4. Configure the webhook:
    • URL: Paste the RunReveal webhook URL you copied
    • Method: POST
    • Content-Type: application/json
    • Authorization: If you enabled bearer token, add Authorization: Bearer YOUR_TOKEN header
  5. Save the webhook configuration

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Table: n8n_logs (44 columns)

ColumnType
workspaceIDString
sourceIDString
sourceTypeLowCardinality(String)
sourceTTLUInt32
receivedAtDateTime
idString
eventTimeDateTime
eventNameString
eventIDString
srcIPString
srcASCountryCodeString
srcASNumberUInt32
srcASOrganizationString
srcCityString
srcConnectionTypeString
srcISPString
srcLatitudeFloat64
srcLongitudeFloat64
srcUserTypeString
dstIPString
dstASCountryCodeString
dstASNumberUInt32
ColumnType
dstASOrganizationString
dstCityString
dstConnectionTypeString
dstISPString
dstLatitudeFloat64
dstLongitudeFloat64
dstUserTypeString
actorMap(String, String)
tagsMap(String, String)
resourcesArray(String)
serviceNameString
enrichmentsArray(Tuple(data Map(String, String), name String, provider String, type String, value String))
readOnlyBool
rawLogString
n8nEventIdString
messageString
workflowIdString
workflowNameString
executionIdString
nodeTypeString
nodeNameString
nodeIdString