Logging to Slack

Slack Notifications for Log Events

RFLIB can post a notification to a Slack channel whenever a log event is published at or above a configured severity threshold. The integration uses a Slack Incoming Webhook and Salesforce Named Credentials to keep the webhook URL secure.

---

Prerequisites

• A Slack workspace where you have permission to create apps and Incoming Webhooks
• Salesforce org with RFLIB v10.2.0 or later deployed
• Permission to manage Named Credentials in Salesforce Setup

---

Step 1 — Create a Slack Incoming Webhook

1. Go to api.slack.com/apps and click Create New App → From scratch.
2. Give the app a name (e.g. RFLIB Logger) and select your workspace.
3. In the left sidebar, click Incoming Webhooks and toggle Activate Incoming Webhooks to On.
4. Click Add New Webhook to Workspace, select the channel where notifications should appear, and click Allow.
5. Copy the generated webhook URL — it looks like:

   https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX
   

   Keep this URL private. It acts as a bearer token — anyone with it can post to your channel.

---

Step 2 — Store the Webhook in a Named Credential

The webhook URL must be stored as a Named Credential so it is never visible in code, Custom Settings, or SOQL queries. In the modern Salesforce model a Named Credential references an External Credential, so this step has three parts: create the External Credential, add a Principal, then create the Named Credential.

2a — Create the External Credential

1. In Salesforce Setup, search for Named Credentials and open it.

2. Select the External Credentials tab and click New.

3. Fill in the fields:

   Field	Value
   Label	Slack
   Name	Slack
   Authentication Protocol	No Authentication

   The Slack Incoming Webhook URL is itself the bearer token, so no additional authentication protocol is required.

4. Click Save.

   

2b — Add a Principal

1. On the Slack External Credential detail page, scroll to the Principals section and click New.

2. Set the Parameter Name to RFLIB Slack and leave the Sequence Number as 1.

3. Click Save. The Principal's Authentication Status should show Configured.

   

The running user (or the Automated Process user, depending on how the RFLIB Log Event Handler flow runs) must be granted access to the Slack External Credential through a Permission Set. Without this access, callouts fail with an authorization error.

2c — Create the Named Credential

1. Back on the Named Credentials tab, click New.

2. Fill in the fields:

   Field	Value
   Label	RFLIB Slack Integration
   Name	RFLIB_SLACK_WEBHOOK (must match exactly)
   URL	Paste the Slack webhook URL from Step 1
   Enabled for Callouts	Checked
   External Credential	Slack

3. Click Save.

   

Sandbox vs Production: Named Credentials are org-specific. You must create this credential separately in each sandbox and in production. Using different webhook URLs per environment lets you route sandbox notifications to a dedicated #rflib-logs-sandbox channel.

---

Step 3 — Configure the Log Level Threshold

1. In Salesforce Setup, search for Custom Settings and open rflib_Logger_Settings__c (Logger Settings).

2. Click Manage, then either edit the existing org default or click New to create one.

3. Set the Slack Log Level field to the minimum severity that should trigger a notification:

   Value	Behaviour
   NONE	Disabled — no Slack notifications sent (default)
   FATAL	Only FATAL events
   ERROR	ERROR and FATAL events
   WARN	WARN, ERROR, and FATAL events
   INFO	Not supported (clamps to WARN at runtime)

   Most teams start with ERROR or WARN.

4. Click Save.

The Slack Log Level setting is a Hierarchy Custom Setting, meaning it can be overridden at the Profile or User level if finer-grained control is needed.

---

How It Works

When a rflib_Log_Event__e Platform Event is published, the RFLIB Log Event Handler flow fires. If the event's level meets the configured Slack Log Level threshold, rflib_SendLogEventSlackAction posts a Block Kit message to the configured Slack channel.

The message includes:

• Log level (in the header)
• Org Name — the name of the Salesforce organization
• Created By — the Salesforce User ID that triggered the event
• Context — the logger context string
• Request ID — the transaction request ID for correlation
• Log Messages — the log output (truncated from the beginning at 2,800 characters so the exception at the tail is visible)
• Platform Info — governor limit snapshot in formatted JSON (truncated at 2,800 characters)

A delivered notification looks like this in Slack:

Execution order in the flow:

Platform Event fires
       │
       ▼
Log to HTTP Endpoint  (rflib_HttpCalloutLogAction)
       │  ← fault skips to next step
       ▼
Send Log Event to Slack  (rflib_SendLogEventSlackAction)  ← NEW
       │  ← fault skips to next step
       ▼
Archive Log Event  (rflib_ArchiveLogAction)
       │  ← fault skips to next step
       ▼
Send Log Event Emails  (rflib_SendLogEventEmailAction)

Each step has a fault connector that continues to the next action, so a Slack failure never prevents archiving or email from running.

---

Troubleshooting

No messages appearing in Slack

• Verify the Named Credential name is exactly RFLIB_SLACK_WEBHOOK (case-sensitive).
• Confirm Slack Log Level in Logger Settings is not NONE and matches the severity of the events you are generating.
• Check the rflib_Application_Event__c object for records with Event_Name__c = 'rflib-slack-log-event-failed' — these capture failure details including HTTP status codes and exception messages.

CalloutException: Unauthorized endpoint error in Application Events

The webhook URL in the Named Credential may be incorrect or the webhook may have been revoked. Regenerate the webhook in Slack and update the Named Credential URL.

Messages are truncated

Slack enforces a 3,000-character limit per text block. RFLIB truncates log messages from the beginning (not the end) at 2,800 characters so the exception at the tail is always visible in Slack, prefixing the block with [TRUNCATED]. Platform info is also truncated at 2,800 characters. This is expected behaviour for very verbose log events. Consider raising the General Log Level setting to reduce noise captured in events.

Notifications firing too frequently

Raise the Slack Log Level threshold (e.g., from WARN to ERROR). You can also set a user- or profile-level override in Logger Settings to suppress Slack notifications for high-volume automated processes.

---

Security Considerations

• The webhook URL is a secret. Store it only in the Named Credential — never in Custom Settings, Apex code, or Custom Metadata.
• Restrict edit access to the Named Credential to System Administrators only.
• Log messages processed by RFLIB are subject to masking rules (rflib_Masking_Rule__mdt) before the Platform Event is published, so sensitive data masked at the logger level will not appear in Slack.
• Rotate the webhook URL periodically via the Slack app settings and update the Named Credential accordingly.