{
    "name": "Kyma application log ingestion",
    "type": "monitor",
    "monitor_type": "query_level_monitor",
    "enabled": true,
    "schedule": {
       "period": {
          "unit": "MINUTES",
          "interval": 1
       }
    },
    "inputs": [
       {
          "search": {
             "indices": [
                "logs-json-kyma-*"
             ],
             "query": {
                "size": 0,
                "aggregations": {},
                "query": {
                   "bool": {
                      "filter": [
                         {
                            "range": {
                               "@timestamp": {
                                  "gte": "{{period_end}}||-5m",
                                  "lte": "{{period_end}}",
                                  "format": "epoch_millis"
                               }
                            }
                         }
                      ]
                   }
                }
             }
          }
       }
    ],
    "triggers": [
       {
          "query_level_trigger": {
             "name": "No Kyma application log ingestion",
             "severity": "2",
             "condition": {
                "script": {
                   "source": "ctx.results[0].hits.total.value < 1",
                   "lang": "painless"
                }
             },
             "actions": [
                {
                   "name": "Notify",
                   "destination_id": "",
                   "message_template": {
                      "source": "Monitor {{ctx.monitor.name}} just entered alert status. Please investigate the issue.\n  - Trigger: {{ctx.trigger.name}}\n  - Severity: {{ctx.trigger.severity}}\n  - Period start: {{ctx.periodStart}}\n  - Period end: {{ctx.periodEnd}}\n  - <link to your instance>/app/alerting",
                      "lang": "mustache"
                   },
                   "throttle_enabled": true,
                   "subject_template": {
                      "source": "No application logs from a Kyma runtime ingested since 5 min",
                      "lang": "mustache"
                   },
                   "throttle": {
                      "value": 60,
                      "unit": "MINUTES"
                   }
                }
             ]
          }
       }
    ]
 }