loki语法记录

- **规则标题**: {{ .Annotations.Values }}
- **触发时值**: {{ .ValueString }}
- **监控对象**: {{ .Labels.Values }}
- **监控指标**: {{ .Status }}
- {{ if .Alerts.Resolved }}**恢复时间**: {{ .StartsAt }}{{else}}**触发时间**: {{ .StartsAt }}{{end}}
- **发送时间**: {{ .StartsAt }}

<clientip> - - <time> "<method> <url> <_>" <status> <_> "<_>" "<_>"

sum by(job) (rate({job="app-nginx"} | pattern `<clientip> - <_> - - <time> "<method> <url> <_>" <status> <_> "<_>" "<_>"` | status > 500 | __error__ != `LabelFilterErr` [5m])) / sum by(job) (rate({job="miniapp-nginx"} [5m]))
groups:
  - name: app-nginx
    rules:
    - alert: LokiNginxRate
      expr: sum by(job) (rate({job="app-nginx"} | pattern `<clientip> - <_> - - <time> "<method> <url> <_>" <status> <_> "<_>" "<_>"` | status > 404 | __error__ != `LabelFilterErr` [5m])) / sum by(job) (rate({job="app-nginx"} [5m])) > 0.05
      for: 1m
      labels:
        severity: critical
        hospital: XXXX
        app: APP
      annotations:
        summary: NGINX 实例的请求错误率(状态码>404)过高。
        description: high request latency
ruler:
  storage:
    type: local
    local:
      directory: /mnt/loki/rules
  rule_path: /mnt/loki/rules/tmp  #临时存放点
  alertmanager_url: http://10.8.67.33:9093
  ring:
    kvstore:
      store: inmemory
  enable_api: true
  enable_sharding: true
  enable_alertmanager_v2: true