PostHog + Slack: alerting workflows that catch churn early

Most mid-market teams adopt PostHog the same way. Engineering installs the SDK, a product manager builds three dashboards, and someone in the founders' Slack channel mentions session replay is cool. Six months later the bill is climbing, four people have viewing access, and nobody can answer the question the CEO actually asked on Monday.

The problem is not PostHog. The problem is that the platform was treated as a passive dashboard. Events get captured, replays get stored, flags get flipped, and none of it is wired to the systems where work actually happens. Slack, Linear, the CRM, the on-call rotation, the Monday leadership review. All disconnected from the data layer.

We build the wiring. This is what mid-market PostHog actually looks like when the automation work is done.

The Idle Signal Problem Most PostHog Customers Have

When PostHog is installed but not operationalised, the symptoms look the same across companies.

• Replays only get watched when someone files a support ticket, which means most rage-clicks and errors are never seen.
• Funnel drop-offs show up in a weekly review, two weeks after the cohort moved on.
• Feature flags ship without any rollback automation, so a bad release goes out wide before anyone notices the error rate.
• LLM costs spike and product hears about it from the AWS bill, not from PostHog.
• Leadership asks "how is the new flow performing" on Monday and nobody has a one-paragraph answer ready.

Automation Plays We Build with PostHog

1. Rage-Click Triage Into Slack and Linear

Trigger: PostHog detects a rage-click event, an error event, or a dead-click on a page tagged as critical (checkout, signup, settings, billing).

Workflow: a webhook fires from PostHog into n8n. The flow pulls the user's session replay link, the prior 30 seconds of events, the user's plan tier, and any open Linear or Intercom tickets. It posts a structured message into a dedicated Slack triage channel. If the same pattern fires three times in 10 minutes from different users, it escalates by auto-filing a Linear ticket tagged for the responsible squad and pinging the on-call engineer.

Outcome: bugs that used to surface days later through support now get triaged the same hour. The squad sees the replay, not just a stack trace. Mean time to detection drops sharply for the issues that actually hurt revenue.

2. Feature Flag Kill-Switch on Error Rate

Trigger: a PostHog feature flag is rolled out to a percentage of users. PostHog's error tracking detects a spike above baseline for the cohort exposed to the flag.

Workflow: a scheduled job polls PostHog's API every two minutes during active rollouts. If the error rate for flag-exposed users exceeds the control group by a defined threshold, it calls the PostHog API to disable the flag, posts a Slack alert in the engineering channel with the error count and a replay link, and creates a follow-up Linear issue with the rollout context attached.

Outcome: bad releases self-revert. Engineers get notified after the blast radius has been contained, not before it widens. The team ships more flags because the cost of a bad one is bounded.

3. LLM Cost and Quality Weekly Digest

Trigger: a scheduled run every Monday at 8am, pulling the prior week from PostHog LLM analytics.

Workflow: an AI agent queries PostHog for total token cost, top three most expensive prompts, p95 latency by model, completion thumbs-down rate, and any traces where the user abandoned the session after the AI response. It writes a structured summary, links each finding to the underlying trace, and posts it into the product Slack channel and the founder's email. Anomalies (cost jump above 30 percent, latency regression, quality drop) trigger a follow-up Linear ticket.

Outcome: the AI product owner gets one paragraph every Monday. Cost surprises get caught the week they happen. Prompt regressions stop hiding in aggregate metrics.

4. Revenue-Weighted Cohort Reports From Stripe

Trigger: Stripe events stream into PostHog through the managed data warehouse, joined to PostHog person profiles by email or customer ID.

Workflow: a SQL view in PostHog computes weekly retention and expansion in MRR, not events. A scheduled report fires every Friday, ranking the top five product behaviours that predict 90-day retention for the current quarter's cohort. Anyone trying a new flow can see, within a week, whether the users who completed it actually paid more six weeks later.

Outcome: product decisions get tied to dollars instead of clicks. The PM team stops optimising for metrics that do not move revenue.

How PostHog Should Integrate With Your Stack

PostHog sits in the middle of the stack. The integration list that matters in practice:

• Slack and Linear for triage routing, alerts, and ticket creation tied to specific cohorts and replay clips.
• Stripe and the CRM (HubSpot or Salesforce) for revenue-weighted cohorts and lifecycle scoring.
• BigQuery, Snowflake, or Postgres as long-term warehouse destinations for analytics that outlive PostHog retention.
• OpenAI, Anthropic, and any model gateway, instrumented with PostHog LLM analytics so every call lands as a trace.
• Sentry or Datadog for low-level infra alerts that need to correlate back to a user session in PostHog.
• n8n or Temporal as the orchestration layer that makes the rest of the stack actually act on PostHog events.

What ROI Actually Looks Like

Ranges are indicative, not promised. Numbers depend on volume, baseline tool stack, and how many of these plays go live.

• Tool consolidation typically lands between $40k and $180k per year for mid-market teams replacing Amplitude or Mixpanel, LaunchDarkly, Hotjar, and a separate LLM observability vendor.
• Mean time to detect a critical bug usually drops from days to hours once rage-click and error triage is routed into Slack and Linear.
• Engineering hours saved on dashboard maintenance and bespoke alerting usually lands between 8 and 20 hours per month, depending on how custom the prior setup was.
• LLM cost reductions of 15 to 35 percent are common in the first quarter, mostly from catching expensive prompt patterns and unnecessary retries in weekly review.

Where Teams Go Wrong

• Treating PostHog as Google Analytics with extra steps. The funnel is the easy part. The integrations and the routing are where the work pays off.
• Skipping identity. If anonymous users are not stitched to authenticated profiles, every cohort is broken and every retention number is wrong.
• Event sprawl. Capturing 400 untyped events because the SDK makes it easy. The teams who win define a tight schema upfront and reject the rest.
• Flags without rollback. Shipping behind a flag is only safer if the kill-switch is automated. A manual rollback at 2am is not a control.
• Ignoring LLM analytics until the bill becomes a problem. The cost curve on AI features hides in the per-call detail, not the aggregate.

The Underlying Mistake: Treating PostHog as a Reporting Tool

PostHog is a data layer. It collects, stores, and exposes signal. That is the easy half. The hard half is wiring the signal into the moments where decisions get made. A bug found in a Friday review is two days of customer pain. A bug routed into Slack within five minutes is a hotfix before lunch. The platform does not change between those two outcomes. The automation does.

Mid-market teams hit a ceiling here because the work that matters is not glamorous. It is event schemas, identity stitching, webhooks, retry logic, and the careful tuning of alert thresholds so the on-call engineer is not paged on noise. None of that is a feature anyone ships in a quarterly review. It is plumbing. Done well, the plumbing is what turns PostHog from a $40k tool into a $400k system.

The teams that figure this out share a habit. They treat the event taxonomy like an API contract, they version it, and they reject pull requests that ship untyped events. Their engineers find new signal in the same place leadership reads the weekly digest. There is no second source of truth, no parallel dashboard built in Looker by someone who lost faith in the analytics team. One stream, one schema, one set of rules.

What an Operational PostHog Setup Looks Like

When the wiring is done, the platform stops being a destination and starts being a router. A few things change at the same time.

• The product team stops asking analysts to pull reports. The weekly digest answers the recurring questions, and PostHog AI handles the ad-hoc ones.
• Engineering stops getting paged on noise. Alerts are scoped to cohorts, plan tiers, and revenue impact, not raw event volume.
• The CS team gets context before the customer does. A churning account triggers a Slack ping with the last 30 days of behaviour and the open ticket history attached.
• Finance stops getting LLM cost surprises. Spend trends show up in the same weekly digest the product team reads, alongside usage and quality metrics.
• Leadership reviews are shorter and sharper. The numbers people argue about land in one place, with replay clips and trace links attached, not as static screenshots in a slide deck.

None of this requires moving off PostHog or building a parallel stack. It requires treating the platform as the central nervous system and connecting the muscles. The work is straightforward. The discipline to actually do it is the rare part.

Three Signals That Tell You PostHog Is Underused

Most teams resist the diagnosis until the cost line forces it. A faster test, before the bill becomes painful:

• Open the session replay tab. If it is empty most days, replay is functioning as expensive storage instead of an early warning system.
• Ask the product team what changed week over week. If the answer requires opening five tabs, the weekly digest play is missing.
• Check how feature flags get rolled back. If the answer is a human in a Slack thread, the kill-switch automation is not built.

Any one of those is a green light to invest in the integration layer. All three together is a sign the team has been paying for a platform without operating it.

Where Moonira Comes In

We do the wiring. The event schema, the identity stitching, the Slack and Linear routing, the kill-switches, the weekly AI agents, and the revenue-weighted reports. PostHog ships the product. We make it operate inside your company. If you are paying for analytics, replay, flags, and LLM observability across four vendors and getting one paragraph of insight a month, talk to us.