[
  {
    "name": "SocketX: recovery event rate is elevated",
    "type": "log alert",
    "query": "logs(\"@event_type:socketx_recovery\").index(\"*\").rollup(\"count\").last(\"5m\") > 10",
    "message": "SocketX is emitting an elevated number of recovery events (connection failures requiring client recovery actions). Check the 'Recent MTE and Recovery Events' panel on the SocketX dashboard and inspect failure_kind / trigger facets.\n\n@your-notification-channel",
    "tags": ["service:socketx-server"],
    "options": {
      "thresholds": { "critical": 10, "warning": 5 },
      "enable_logs_sample": true,
      "notify_no_data": false,
      "renotify_interval": 0,
      "groupby_simple_monitor": false
    }
  },
  {
    "name": "SocketX: permanent connection failures detected",
    "type": "log alert",
    "query": "logs(\"@recovery_action:fail_permanently\").index(\"*\").rollup(\"count\").last(\"5m\") > 0",
    "message": "One or more SocketX connections failed permanently (recovery_action=fail_permanently) — clients were told not to retry. This usually indicates a protocol violation, configuration problem (DOMAIN_MAP / origin rejection), or an incompatible client.\n\n@your-notification-channel",
    "tags": ["service:socketx-server"],
    "options": {
      "thresholds": { "critical": 0 },
      "enable_logs_sample": true,
      "notify_no_data": false,
      "renotify_interval": 0
    }
  },
  {
    "name": "SocketX: error-level log spike",
    "type": "log alert",
    "query": "logs(\"service:socketx-server status:error\").index(\"*\").rollup(\"count\").last(\"5m\") > 20",
    "message": "SocketX is logging errors at an elevated rate. Review the error stream for MTE status codes, upstream connectivity failures, or license problems.\n\n@your-notification-channel",
    "tags": ["service:socketx-server"],
    "options": {
      "thresholds": { "critical": 20, "warning": 10 },
      "enable_logs_sample": true,
      "notify_no_data": false,
      "renotify_interval": 0
    }
  }
]