id: security_alert_handler
namespace: security

tasks:
  - id: handle_alert
    type: io.kestra.plugin.core.log.Log
    message: "Security alert: {{ trigger.count }} new entries detected"

  - id: process_logs
    type: io.kestra.plugin.core.log.Log
    message: "{{ trigger.logs }}"

triggers:
  - id: watch_security_logs
    type: io.kestra.plugin.grafana.loki.Trigger
    url: http://loki.example.com:3100
    authToken: "{{ secret('LOKI_TOKEN') }}"
    tenantId: production
    query: '{job="security", level="critical"} |= "unauthorized access"'
    interval: PT1M
    maxRecords: 100

id: error_monitor
namespace: monitoring

tasks:
  - id: send_alert
    type: io.kestra.plugin.notifications.slack.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "text": "🚨 {{ trigger.count }} errors detected",
        "blocks": [
          {
            "type": "section",
            "text": {
              "type": "mrkdwn",
              "text": "*Query:* {{ trigger.query }}"
            }
          }
        ]
      }

triggers:
  - id: monitor_errors
    type: io.kestra.plugin.grafana.loki.Trigger
    url: https://loki.example.com:3100
    authToken: "{{ secret('LOKI_TOKEN') }}"
    tenantId: team-platform
    query: '{job="api", level="error"} |~ "timeout|connection refused"'
    interval: PT5M
    since: 10m

id: trigger
type: io.kestra.plugin.grafana.loki.Trigger
id: payment_failure_handler
namespace: payments

triggers:
  - id: watch_payment_failures
    type: io.kestra.plugin.grafana.loki.Trigger
    url: http://loki:3100
    tenantId: payments-team
    query: '{application="payment-gateway"} |= "payment failed" | json | amount > 1000'
    interval: PT30S
    maxRecords: 50
    since: 5m

tasks:
  - id: investigate
    type: io.kestra.plugin.core.log.Log
    message: "Investigating {{ trigger.count }} high-value payment failures"