{
  "name": "High error rate",
  "description": "More than 100 errors in one minute",
  "enabled": true,
  "kind": "scheduled",
  "query": {
    "language": "sql",
    "statement": "SELECT count(*) AS c FROM app WHERE level = 'error'",
    "period_secs": 60,
    "stream": { "name": "app", "stream_type": "logs" }
  },
  "trigger": {
    "operator": "gt",
    "threshold": 100,
    "for_periods": 1,
    "silence_secs": 300
  },
  "thresholds": [],
  "severity": "critical",
  "escalation_policy_id": "<policy-id>",
  "labels": { "team": "checkout" },
  "annotations": {}
}