> ## Documentation Index
> Fetch the complete documentation index at: https://felan.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# PostHog

> Connect a PostHog project to Felan.

The PostHog integration connects one PostHog project to a Felan team. Its
current automation support includes log-alert lifecycle events. Felan does not
create automations for you: create an automation and choose the alert event and
filters it should handle.

## Connect

<Steps>
  <Step title="Open Integrations">
    Select the Felan team that should receive PostHog alert events, then open **Integrations**.
  </Step>

  <Step title="Authorize PostHog">
    Find **PostHog**, select **Connect**, and approve the least-privilege OAuth request.
  </Step>

  <Step title="Select a project">
    Choose the PostHog project Felan should use. Felan also makes its current Logs alerts available as automation events through webhook destinations.
  </Step>

  <Step title="Create an automation">
    Open **Automations**, create an event automation, select a PostHog log-alert event, and add the filters and instructions you need.
  </Step>
</Steps>

The connection supports PostHog Cloud regions `us`, `us.i`, `eu`, and `eu.i`.

## Alert events

Felan receives these lifecycle events:

| Event                                 | Meaning                                                       |
| ------------------------------------- | ------------------------------------------------------------- |
| `com.posthog.log_alert.firing`        | The alert breached its threshold.                             |
| `com.posthog.log_alert.resolved`      | A firing alert returned below its threshold.                  |
| `com.posthog.log_alert.auto_disabled` | PostHog disabled the alert after repeated evaluator failures. |
| `com.posthog.log_alert.errored`       | An alert evaluation failed.                                   |

The normalized event data includes `alert_id`, `alert_name`, counts and
threshold values, `window_minutes`, `service_names`, `severity_levels`, and
PostHog alert/log URLs. The event ID from PostHog is preserved for delivery
idempotency.

## Filtering automations

Event filters use JSONPath against the normalized event. Examples:

```text theme={null}
$.data.alert_id equals 11111111-1111-1111-1111-111111111111
$.data.alert_name contains Agent
$.data.service_names[*] contains felan-agent
$.data.severity_levels[*] equals error
```

PostHog can notify repeatedly while an alert remains breached, depending on its
notification cooldown. Use the alert ID in filters or make the automation
idempotent rather than assuming every firing notification is a new incident.

## Reconcile and disconnect

The initial project selection subscribes the alerts that exist at that time.
If a new alert is created later, open the connected PostHog integration and
choose **Sync project**. Existing subscriptions are skipped and only new
alerts are attached.

Disconnecting PostHog removes Felan's managed alert destinations before the
OAuth connection and local credentials are disabled. Felan does not read or
stream the project's general analytics event firehose through this integration.