{
  "title": "WARNING: repeated accel-ppp error/warning from one server",
  "description": "The same category of accel-ppp error/warning is repeating from one server - a single occurrence can be transient (a RADIUS retry, a one-off MAC change), but sustained repetition usually means a stuck session or an ongoing condition. Confirmed live on 2026-07-23 against a real 1GB accel-ppp log: 'can't determine router address' repeated 2,746 times over ~4 hours for two specific subscriber interfaces before self-resolving, with no alert firing at the time since this alert didn't exist yet. Threshold (>5 in 5 minutes) is set low enough to have caught that incident within its first cycle, while still tolerating an occasional single warning. Query requires event_type to exist (not just vendor:accel-ppp) - confirmed live that vendor alone also matches routine traffic tagged only by the generic accelppp_interface_tag fallback (which never sets event_type), producing false '(Empty Value)' group_by matches otherwise.",
  "priority": 2,
  "alert": true,
  "config": {
    "type": "aggregation-v1",
    "query": "vendor:accel-ppp AND event_type:*",
    "streams": ["__SERVERS_STREAM_ID__"],
    "group_by": ["gl2_remote_ip", "event_type"],
    "series": [{"type": "count", "id": "count-", "field": null}],
    "conditions": {"expression": {"expr": ">", "left": {"expr": "number-ref", "ref": "count-"}, "right": {"expr": "number", "value": 5.0}}},
    "search_within_ms": 300000,
    "execute_every_ms": 300000,
    "event_limit": 50
  },
  "field_spec": {},
  "key_spec": [],
  "notification_settings": {"grace_period_ms": 900000, "backlog_size": 5},
  "notifications": [{"notification_id": "__DISCORD_NOTIFICATION_ID__"}]
}