Skip to content

Log streaming#

Feature availability

Log Streaming is available on all Enterprise plans.

Log streaming allows you to send events from n8n to your own logging tools. This allows you to manage your n8n monitoring in your own alerting and logging processes.

Set up log streaming#

To use log streaming, you have to add a streaming destination.

  1. Navigate to Settings > Log Streaming.
  2. Select Add new destination.
  3. Choose your destination type. n8n opens the New Event Destination modal.
  4. In the New Event Destination modal, enter the configuration information for your event destination. These depend on the type of destination you're using.
  5. Select Events to choose which events to stream.
  6. Select Save.

Self-hosted users

If you self-host n8n, you can configure additional log streaming behavior using Environment variables. You can also manage destinations from environment variables, see Configure log streaming destinations using environment variables.

Events#

The following events are available. You can choose which events to stream in Settings > Log Streaming > Events.

  • Workflow
    • Started
    • Success
    • Failed
    • Cancelled
  • Node executions
    • Started
    • Finished
  • Audit
    • User login success
    • User login failed
    • User signed up
    • User updated
    • User deleted
    • User invited
    • User invitation accepted
    • User re-invited
    • User email failed
    • User reset requested
    • User reset
    • User credentials created
    • User credentials shared
    • User credentials updated
    • User credentials deleted
    • User API created
    • User API deleted
    • User MFA enabled
    • User MFA disabled
    • User execution deleted
    • Execution data revealed
    • Execution data reveal failed
    • Package installed
    • Package updated
    • Package deleted
    • Workflow created
    • Workflow deleted
    • Workflow updated
    • Workflow archived
    • Workflow unarchived
    • Workflow activated
    • Workflow deactivated
    • Workflow version updated
    • Workflow executed
    • Workflow waiting
    • Workflow resumed
    • Variable created
    • Variable updated
    • Variable deleted
    • External secrets provider settings saved
    • External secrets provider reloaded
    • External secrets connection created
    • External secrets connection updated
    • External secrets connection deleted
    • External secrets connection tested
    • External secrets connection reloaded
    • Personal publishing restricted enabled
    • Personal publishing restricted disabled
    • Personal sharing restricted enabled
    • Personal sharing restricted disabled
    • 2FA enforcement enabled
    • 2FA enforcement disabled
    • Token exchange succeeded
    • Token exchange failed
    • Token exchange embed login
    • Token exchange embed login failed
    • Token exchange identity linked
    • Token exchange user provisioned
    • Token exchange role updated
    • Role mapping roles resolved
    • Role mapping rule created
    • Role mapping rule updated
    • Role mapping rule deleted
    • Role mapping rules bulk deleted
  • Worker
    • Started
    • Stopped
  • AI node logs
    • Memory get messages
    • Memory added message
    • Output parser parsed
    • Retriever get relevant documents
    • Embeddings embedded document
    • Embeddings embedded query
    • Document processed
    • Text splitter split
    • Tool called
    • Vector store searched
    • LLM generated
    • LLM error
    • Vector store populated
    • Vector store updated
  • Runner
    • Task requested
    • Response received
  • Queue
    • Job enqueued
    • Job dequeued
    • Job completed
    • Job failed
    • Job stalled

Destinations#

n8n supports three destination types:

  • A syslog server
  • A generic webhook
  • A Sentry client

Configure using environment variables#

If you self-host n8n, you can manage log streaming destinations from environment variables instead of the UI. Available from n8n v2.19.0. Set N8N_LOG_STREAMING_MANAGED_BY_ENV to true and provide your destinations as a JSON array in N8N_LOG_STREAMING_DESTINATIONS. n8n reapplies these on every startup and locks the Log Streaming UI as read-only. See Manage instance settings using environment variables for the full pattern.

Variable Type Default Description
N8N_LOG_STREAMING_MANAGED_BY_ENV Boolean false Set to true to manage log streaming from environment variables. When true, n8n applies the log streaming variables on every startup and locks the matching UI controls.
N8N_LOG_STREAMING_DESTINATIONS JSON string - JSON array of log streaming destinations. Each destination is an object with a type of webhook, syslog, or sentry, plus the configuration for that type.

Common fields#

Every destination accepts these fields, regardless of type.

Field Type Required Description
type "webhook" | "syslog" | "sentry" Yes Destination type. Determines which type-specific fields apply.
label string No Display name shown in the UI.
enabled boolean No Whether the destination forwards events.
subscribedEvents string[] No Event names or group prefixes to forward (for example n8n.audit, n8n.workflow).
anonymizeAuditMessages boolean No Strip sensitive payload data from n8n.audit.* events.
circuitBreaker object No Failure-protection settings. See Circuit breaker.

Webhook#

Field Type Required Default Description
url string (URL) Yes - Endpoint that receives the event payload.
method "GET" | "POST" | "PUT" No "POST" HTTP method used for delivery.
sendQuery boolean No false Whether to send query parameters.
specifyQuery "keypair" | "json" No "keypair" Format for query parameters when sendQuery is true.
queryParameters { parameters: [{ name, value }] } No - Query parameters as key/value pairs. Used when specifyQuery is "keypair".
jsonQuery string No "" Query parameters as a JSON string. Used when specifyQuery is "json".
sendHeaders boolean No false Whether to send headers.
specifyHeaders "keypair" | "json" No "keypair" Format for headers when sendHeaders is true.
headerParameters { parameters: [{ name, value }] } No - Headers as key/value pairs. Used when specifyHeaders is "keypair".
jsonHeaders string No "" Headers as a JSON string. Used when specifyHeaders is "json".
options object No {} Connection-level options. See Webhook options.

Webhook options#

Field Type Required Default Description
allowUnauthorizedCerts boolean No false Ignore SSL certificate validation.
queryParameterArrays "repeat" | "brackets" | "indices" No "brackets" Array format used in query parameters. Used when sendQuery is true.
redirect { redirect: { followRedirects, maxRedirects } } No { redirect: {} } Follow HTTP redirects. followRedirects defaults to false; maxRedirects defaults to 21.
proxy { proxy: { protocol, host, port } } No { proxy: {} } HTTP/HTTPS proxy. protocol is "https" or "http"; host defaults to "127.0.0.1"; port defaults to 9000.
timeout integer ≥ 1 (ms) No 5000 Time to wait for the server to start the response before aborting.
socket { keepAlive, maxSockets, maxFreeSockets } No { keepAlive: true, maxSockets: 50, maxFreeSockets: 5 } Socket pool configuration. maxSockets and maxFreeSockets are integers ≥ 1. 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
[
  {
    "type": "webhook",
    "label": "Audit",
    "subscribedEvents": ["n8n.audit", "n8n.workflow"],
    "anonymizeAuditMessages": true,
    "url": "https://hooks.example.com/n8n",
    "method": "POST",
    "sendHeaders": true,
    "specifyHeaders": "keypair",
    "headerParameters": {
      "parameters": [
        { "name": "Authorization", "value": "Bearer s3cret" }
      ]
    },
    "options": {
      "timeout": 5000,
      "redirect": { "redirect": { "followRedirects": true, "maxRedirects": 5 } }
    }
  }
]

Syslog#

Field Type Required Default Description
host string Yes - Syslog server hostname or IP.
port number No 514 Syslog server port.
protocol "udp" | "tcp" | "tls" No "udp" Transport protocol.
tlsCa string When protocol is "tls" "" PEM-formatted CA certificate used for the TLS connection.
facility number No 16 Syslog facility code. Allowed values: 0 (Kernel), 1 (User), 3 (System), 13 (Audit), 14 (Alert), 16 to 23 (Local0 to Local7).
app_name string No "n8n" Value used as the syslog APP-NAME. 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
[
  {
    "type": "syslog",
    "label": "SIEM",
    "subscribedEvents": ["n8n.audit", "n8n.workflow"],
    "host": "syslog.example.com",
    "port": 514,
    "protocol": "tls",
    "tlsCa": "-----BEGIN CERTIFICATE-----\n…\n-----END CERTIFICATE-----",
    "facility": 16,
    "app_name": "n8n"
  }
]

Sentry#

Field Type Required Default Description
dsn string (URL) Yes - Sentry DSN client key. 
1
2
3
4
5
6
7
8
[
  {
    "type": "sentry",
    "label": "Sentry prod",
    "subscribedEvents": ["n8n.workflow"],
    "dsn": "https://[email protected]/1"
  }
]

Circuit breaker#

A circuit breaker temporarily stops delivery to a destination after repeated failures, preventing load on a struggling downstream service. Available on every destination type.

Field Type Required Default Description
maxFailures integer ≥ 1 No 5 n8n stops sending requests to the destination once failures within failureWindow reach this number.
failureWindow integer ≥ 100 (ms) No 60000 Sliding window for counting failures. Older failures expire. 
1
{ "circuitBreaker": { "maxFailures": 3, "failureWindow": 30000 } }

Complete example#

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
N8N_LOG_STREAMING_MANAGED_BY_ENV=true
N8N_LOG_STREAMING_DESTINATIONS='[
  {
    "type": "webhook",
    "label": "Ops webhook",
    "enabled": true,
    "subscribedEvents": ["n8n.workflow", "n8n.audit"],
    "anonymizeAuditMessages": true,
    "url": "https://hooks.example.com/n8n",
    "method": "POST",
    "sendHeaders": true,
    "specifyHeaders": "keypair",
    "headerParameters": {
      "parameters": [
        { "name": "Authorization", "value": "Bearer s3cret" }
      ]
    },
    "circuitBreaker": { "maxFailures": 5, "failureWindow": 60000 }
  },
  {
    "type": "sentry",
    "label": "Sentry prod",
    "subscribedEvents": ["n8n.workflow"],
    "dsn": "https://[email protected]/1"
  }
]'
This page was