rule "http_server_error" do
  on "http.transaction"
  where not incomplete
  when error and http.status >= "500"
  cooldown "10s"
  group_by service
  emit "http.server_error" do
    severity = "error"
    message = "HTTP server returned an error"
    status = http.status
    duration_ms = duration_ms
    response = http.response
  end
end

rule "database_error_rate" do
  on "db.transaction"
  where not incomplete
  group_by service, db.system
  window "60s"
  when count() >= 20 and ratio(error) >= 0.10
  emit "database.error_rate" do
    severity = "warning"
    message = "Database request error rate exceeded 10 percent"
    requests = count()
    error_ratio = ratio(error)
  end
end

rule "analysis_incomplete" do
  on "analysis.anomaly"
  when incomplete
  emit "analysis.incomplete" do
    severity = "warning"
    message = "Analysis data is incomplete"
    reason = analysis.reason
  end
end