sql

NOT http_host:"box.xx.com" | select 400 as status_code,http_host,count_if(status = 400 ) as error_count,round((count_if(status = 400 )) *100.0/count(*),2) as status_per where regexp_like(http_host, '[a-zA-Z]+') group by http_host having error_count > 10 and status_per > 5

template

{
	"msg_type": "post",
	"content": {
		"post": {
			"zh_cn": {
				"title": "{{if eq .NotifyType 1}}【CLS告警】{{else}}【CLS恢复】{{end}}",
				"content": [
					[{
							"tag": "text",
							"text": "告警名称："
						},
						{
							"tag": "a",
							"href": "{{.QueryUrl}}",
							"text": "{{.Alarm}}( 日志主题：{{.Topic}})"
						},
						{
							"tag": "text",
							"text": "\n开始时间：{{escape .StartTime}} \n{{if eq .NotifyType 1}}【告警详情】：\n{{range .QueryResult[0]}} 域名：{{.http_host}}，状态码：{{.status_code}}，数量：{{.error_count}}，占比：{{.status_per}}%\n{{end}}{{else}}\n结束时间: {{.NotifyTime}}{{end}}"
						},
						{
							"tag": "a",
							"href": "https://console.cloud.tencent.com/cls/alarm/list/detail?region=ap-shanghai&id={{.AlarmID}}",
							"text": "\n修改告警策略"
						}
					]
				]
			}
		}
	}
}

demo