ingestlayer/recipes

Monitor error spikes in Slack

Turn a sudden burst of one error into a single, classified alert — production only, severity already decided — instead of a wall of duplicate noise.

01source

sourcesdk.eventTypeScript SDK
matcherror.spike

02pipeline · 2 steps

  • 01CTLfilter.matchenv = prod only
  • 02ENRclassifyseverity → page | notify | ignore

03destinations · 1

  • toslackSlack
    channel#alerts

the event

You emit error.spike with this shape. The TypeScript SDK keeps the call type-safe, and the event is stored whole — so every field below is available to the pipeline by name.

  • servicestring
  • errorstringerror class
  • countnumberin window
  • windowstringe.g. 5m
  • envstringprod | staging

emit it

From your code with the TypeScript SDK — or any language over the REST endpoint and signed webhook ingress.

emit error.spike
import { ingest } from "@ingestlayer/sdk";

await ingest("error.spike", {
  service: "checkout",
  error:   err.name,
  count:   windowCount,
  window:  "5m",
  env:     process.env.NODE_ENV,
});

route it to Slack

Post to any channel in your workspace. Connect once with OAuth, pick the channel per pipeline.

  1. 01

    connect your workspace

    Authorize the ingestlayer Slack app over OAuth from the destinations page. We hold only a channel-scoped bot token, in-region, in the same KMS as your other credentials.

  2. 02

    pick a channel

    Choose any public channel, or invite the bot to a private one. The channel is set per pipeline, so different events can land in different places.

  3. 03

    map the message

    Reference event fields with $event.* in the message template. The default renders a titled block with the event name and its key fields.

in slackdelivered
┌─ #alerts ──────────────────────────────┐
│  ingestlayer  APP                       │
│  user.signed_up                         │
│  email   ada@acme.com                   │
│  plan    pro                            │
│  source  marketing-site                 │
└─────────────────────────────────────────┘

notes

questions

Can staging stay out of the on-call channel?
Filter on env so only production spikes page anyone; staging can route to a quieter place or nowhere.
How is severity decided?
classify weighs the error class and count against your prompt and returns a typed severity the pipeline branches on.
Will one bad minute spam the channel?
You emit one spike event per window, so a burst is summarized as a count rather than streamed error by error.
build this pipelineor read the quickstart →

error spikes, routed elsewhere

more, into Slack