{
  "title": "WARNING: abnormal syslog volume from network equipment",
  "description": "A single switch/OLT/router is sending far more syslog messages than normal - often a symptom of interface flapping, an ARP/MAC-move loop, or a spanning-tree issue. Threshold calibrated live on 2026-07-22 against real network equipment traffic: the observed device was steadily sending ~30-60 msgs/5min (~360/hour) under normal conditions, so the threshold gives roughly 10x headroom above that baseline.",
  "priority": 2,
  "alert": true,
  "config": {
    "type": "aggregation-v1",
    "query": "*",
    "streams": ["__NETWORK_STREAM_ID__"],
    "group_by": ["gl2_remote_ip"],
    "series": [{"type": "count", "id": "count-", "field": null}],
    "conditions": {"expression": {"expr": ">", "left": {"expr": "number-ref", "ref": "count-"}, "right": {"expr": "number", "value": 500.0}}},
    "search_within_ms": 300000,
    "execute_every_ms": 300000,
    "event_limit": 50
  },
  "field_spec": {},
  "key_spec": [],
  "notification_settings": {"grace_period_ms": 900000, "backlog_size": 5},
  "notifications": [{"notification_id": "__DISCORD_NOTIFICATION_ID__"}]
}