Elastic Alert Notification via Microsoft Graph Email - n8n Workflow

• DevOps engineers needing reliable monitoring automation.


• IT operations teams requiring immediate notification of Elastic stack alerts.


• Users looking for advanced n8n templates integrating scheduling, conditional logic, and external APIs.


• Anyone who wants to leverage Microsoft Graph API for email automation within an n8n workflow.

Managing monitoring alerts is crucial for maintaining system reliability. This powerful n8n workflow streamlines the process of fetching alerts from a custom Elastic API (PRISM) and ensuring immediate delivery via a professional channel, Microsoft Outlook/Exchange.

Unlike simple webhook integrations, this n8n template uses a scheduled n8n trigger to poll the API, providing resilience and flexibility. It processes the response, applies conditional checks, and then loops through multiple alerts to ensure each one generates a unique, formatted email notification. Utilizing the httpRequest n8n node with OAuth2 authentication ensures secure communication with the Microsoft Graph API, making this a robust n8n solution for enterprise monitoring tasks. This comprehensive n8n workflow dramatically reduces response time to critical events.

This n8n workflow operates on a recurring schedule to provide continuous monitoring:

1. Scheduled Polling (n8n trigger): The workflow starts using the Schedule Trigger n8n trigger at predefined intervals.


2. Fetch Alerts: An HTTP Request n8n node, named "Get Elastic Alert," calls the configured PRISM Elastic API endpoint to retrieve any newly generated alerts.


3. Conditional Check: The If n8n node, "Response is not empty," checks the data returned by the API. If the response contains alerts (the 'true' path), the workflow proceeds to process the data. If no alerts are present (the 'false' path), the workflow terminates gracefully using a No Operation n8n node.


4. Batch Processing: If alerts are found, the Split In Batches n8n node, "Loop Over Each Alert Items," ensures that if multiple alerts are returned, they are processed individually.


5. Send Notification: For each alert item, a subsequent HTTP Request n8n node, "Send Email Notification," connects to the Microsoft Graph API (/sendMail). This n8n node uses dynamic expressions to insert the alert details (name, severity, timestamp, and message) into a rich HTML email body, delivering a professional and informative notification to the specified recipient. The use of OAuth2 within this n8n node guarantees secure authentication.

To deploy this efficient n8n workflow, follow these steps:

1. Import: Copy the provided n8n workflow JSON data and paste it into your n8n instance via the 'New' menu > 'Import from JSON'.


2. Configure Schedule: Customize the Schedule Trigger n8n trigger to run at your desired frequency (e.g., every 5 minutes).


3. Configure Elastic API Endpoint: Locate the "Get Elastic Alert" n8n node and update the URL parameter (https://your-prism-elastic-api-endpoint.com/alerts) to point to your actual alert retrieval endpoint.


4. Set Up Microsoft Graph Credentials: For the "Send Email Notification" n8n node, you must configure an OAuth2 credential for Microsoft Graph. This requires setting up an application registration in Azure AD with the Mail.Send permission.


5. Customize Email Details: In the "Send Email Notification" n8n node's body parameters, replace [email protected] with the actual recipient address and modify the email subject and content as needed. The dynamic data retrieval from the previous n8n node items is already set up using expressions like {{$json["alert_name"]}}.

Schedule Trigger (n8n trigger): This is the entry point, defining the polling frequency for the entire n8n workflow.
Get Elastic Alert (HTTP Request n8n node): Responsible for initiating the API call to the external Elastic monitoring service to fetch raw alert data.
Response is not empty (If n8n node): Implements core logic flow control. It branches the n8n workflow based on whether the API call returned successful alert data or an empty result.
Loop Over Each Alert Items (Split In Batches n8n node): Essential for handling scenarios where the API returns multiple alerts in a single run, ensuring the next n8n node processes each alert one by one.

• Send Email Notification (HTTP Request n8n node): The final action n8n node. It uses a POST request, OAuth2 authentication, and JSON parameters to construct and send a detailed HTML email via the Microsoft Graph /sendMail endpoint. Key configuration includes embedding alert properties into the email content.