Skip to main content
The PostHog integration connects one PostHog project to a Felan team. It supports log-alert lifecycle automations and bounded, read-only investigation of the connected project’s logs, errors, web analytics, product analytics, dashboards, and insights through Felan’s PostHog skill. Felan does not create automations for you: create an automation and choose the alert event and filters it should handle.

​
Connect

1

Open Integrations

Select the Felan team that should receive PostHog alert events, then open Integrations.
2

Authorize PostHog

Find PostHog, select Connect, and approve the least-privilege OAuth request.
3

Select a project

Choose the PostHog project Felan should use. Felan also makes its current Logs alerts available as automation events through webhook destinations.
4

Create an automation

Open Automations, create an event automation, select a PostHog log-alert event, and add the filters and instructions you need.
The connection supports PostHog Cloud regions us, us.i, eu, and eu.i.

​
Read project data

When an agent investigates a question, it can query the selected project on demand using the customer OAuth connection. Reads are bounded: HogQL is limited to one SELECT or WITH query and at most 100 rows; Logs queries cover at most seven days and 1,000 entries; lists return at most 100 items. Felan does not continuously stream or bulk-export the project’s analytics events. The integration requests organization:read, project:read, logs:read, logs:write, query:read, dashboard:read, insight:read, and error_tracking:read. logs:write is used only to attach and remove Felan’s managed log-alert webhook destinations; the agent CLI remains read-only. Existing connections need to be reauthorized to add these permissions. PostHog logs, events, properties, stack traces, URLs, dashboard names, and descriptions are customer data. Felan’s agent treats them as information to analyze, not instructions to follow. Felan’s internal PostHog telemetry credentials are separate and are never used to access your project.

​
Alert events

Felan receives these lifecycle events: The normalized event data includes alert_id, alert_name, counts and threshold values, window_minutes, service_names, severity_levels, and PostHog alert/log URLs. The event ID from PostHog is preserved for delivery idempotency.

​
Filtering automations

Event filters use JSONPath against the normalized event. Examples:
PostHog can notify repeatedly while an alert remains breached, depending on its notification cooldown. Use the alert ID in filters or make the automation idempotent rather than assuming every firing notification is a new incident.

​
Reconcile and disconnect

The initial project selection subscribes the alerts that exist at that time. If a new alert is created later, open the connected PostHog integration and choose Sync project. Existing subscriptions are skipped and only new alerts are attached. Disconnecting PostHog removes Felan’s managed alert destinations before the OAuth connection and local credentials are disabled.