update migration, add query to alerts json in demo script

Author: nikhilsinhaparseable

resources/ingest_demo_data.sh

@@ -415,7 +415,7 @@ create_alerts() {
     echo "Creating alerts with target ID: $target_id"
 
     # Alert 1: Error Count (severity_number = 18)
-    alert1_json="{\"severity\":\"high\",\"title\":\"error count\",\"alertType\":\"threshold\",\"thresholdConfig\":{\"operator\":\">\",\"value\":1000},\"evalConfig\":{\"rollingWindow\":{\"evalStart\":\"5h\",\"evalEnd\":\"now\",\"evalFrequency\":1}},\"targets\":[\"$target_id\"]}"
+    alert1_json="{\"severity\":\"high\",\"title\":\"error count\",\"alertType\":\"threshold\",\"query\": \"select count(severity_number) as count_severity_number from demodata where severity_number=18\",\"thresholdConfig\":{\"operator\":\">\",\"value\":1000},\"evalConfig\":{\"rollingWindow\":{\"evalStart\":\"5h\",\"evalEnd\":\"now\",\"evalFrequency\":1}},\"targets\":[\"$target_id\"]}"
 
     response1=$(curl_with_retry "$P_URL/api/v1/alerts" "POST" "$alert1_json" "application/json" 3)
     if [[ $? -eq 0 ]]; then
@@ -426,7 +426,7 @@ create_alerts() {
     fi
 
     # Alert 2: 400 Errors
-    alert2_json="{\"severity\":\"critical\",\"title\":\"400 Errors\",\"alertType\":\"threshold\",\"thresholdConfig\":{\"operator\":\">\",\"value\":10},\"evalConfig\":{\"rollingWindow\":{\"evalStart\":\"5h\",\"evalEnd\":\"now\",\"evalFrequency\":1}},\"targets\":[\"$target_id\"]}"
+    alert2_json="{\"severity\":\"critical\",\"title\":\"400 Errors\",\"alertType\":\"threshold\",\"query\": \"select count(body) as count_body from demodata where body like '%400%'\",\"thresholdConfig\":{\"operator\":\">\",\"value\":10},\"evalConfig\":{\"rollingWindow\":{\"evalStart\":\"5h\",\"evalEnd\":\"now\",\"evalFrequency\":1}},\"targets\":[\"$target_id\"]}"
 
     response2=$(curl_with_retry "$P_URL/api/v1/alerts" "POST" "$alert2_json" "application/json" 3)
     if [[ $? -eq 0 ]]; then
@@ -437,7 +437,7 @@ create_alerts() {
     fi
 
     # Alert 3: Trace ID null
-    alert3_json="{\"severity\":\"high\",\"title\":\"Trace ID null\",\"alertType\":\"threshold\",\"thresholdConfig\":{\"operator\":\"is null\",\"value\":null},\"evalConfig\":{\"rollingWindow\":{\"evalStart\":\"5h\",\"evalEnd\":\"now\",\"evalFrequency\":1}},\"targets\":[\"$target_id\"]}"
+    alert3_json="{\"severity\":\"high\",\"title\":\"Trace ID null\",\"alertType\":\"threshold\",\"query\": \"select count(trace_id) as count_trace_id from demodata where trace_id is null\",\"thresholdConfig\":{\"operator\":\"is null\",\"value\":null},\"evalConfig\":{\"rollingWindow\":{\"evalStart\":\"5h\",\"evalEnd\":\"now\",\"evalFrequency\":1}},\"targets\":[\"$target_id\"]}"
     response3=$(curl_with_retry "$P_URL/api/v1/alerts" "POST" "$alert3_json" "application/json" 3)
     if [[ $? -eq 0 ]]; then
         echo "Alert 3 (Trace ID null) created successfully"

src/alerts/mod.rs

@@ -681,19 +681,30 @@ impl AlertConfig {
     ) -> Result<String, AlertError> {
         let column = aggregate_config["column"].as_str().unwrap_or("*");
 
-        let query = if column == "*" {
-            format!(
-                "SELECT {}(*) as alert_value FROM \"{stream}\"",
-                aggregate_function.to_string().to_uppercase()
-            )
-        } else if matches!(aggregate_function, AggregateFunction::Count) && column != "*" {
-            // COUNT with specific column should handle NULLs differently
-            format!("SELECT COUNT(\"{column}\") as alert_value FROM \"{stream}\"",)
-        } else {
-            format!(
-                "SELECT {}(\"{column}\") as alert_value FROM \"{stream}\"",
-                aggregate_function.to_string().to_uppercase()
-            )
+        let query = match aggregate_function {
+            AggregateFunction::CountDistinct => {
+                if column == "*" {
+                    format!("SELECT COUNT(DISTINCT *) as alert_value FROM \"{stream}\"")
+                } else {
+                    format!("SELECT COUNT(DISTINCT \"{column}\") as alert_value FROM \"{stream}\"")
+                }
+            }
+            _ => {
+                if column == "*" {
+                    format!(
+                        "SELECT {}(*) as alert_value FROM \"{stream}\"",
+                        aggregate_function.to_string().to_uppercase()
+                    )
+                } else if matches!(aggregate_function, AggregateFunction::Count) && column != "*" {
+                    // COUNT with specific column should handle NULLs differently
+                    format!("SELECT COUNT(\"{column}\") as alert_value FROM \"{stream}\"")
+                } else {
+                    format!(
+                        "SELECT {}(\"{column}\") as alert_value FROM \"{stream}\"",
+                        aggregate_function.to_string().to_uppercase()
+                    )
+                }
+            }
         };
         Ok(query)
     }
@@ -760,13 +771,40 @@ impl AlertConfig {
 
     /// Format a single WHERE clause
     fn format_where_clause(column: &str, operator: &WhereConfigOperator, value: &str) -> String {
-        if matches!(
-            operator,
-            WhereConfigOperator::IsNull | WhereConfigOperator::IsNotNull
-        ) {
-            format!("\"{}\" {}", column, operator.as_str())
-        } else {
-            format!("\"{}\" {} '{}'", column, operator.as_str(), value)
+        match operator {
+            WhereConfigOperator::IsNull | WhereConfigOperator::IsNotNull => {
+                format!("\"{}\" {}", column, operator.as_str())
+            }
+            WhereConfigOperator::Contains => {
+                format!("\"{}\" LIKE '%{}%'", column, value.replace('\'', "''"))
+            }
+            WhereConfigOperator::BeginsWith => {
+                format!("\"{}\" LIKE '{}%'", column, value.replace('\'', "''"))
+            }
+            WhereConfigOperator::EndsWith => {
+                format!("\"{}\" LIKE '%{}'", column, value.replace('\'', "''"))
+            }
+            WhereConfigOperator::DoesNotContain => {
+                format!("\"{}\" NOT LIKE '%{}%'", column, value.replace('\'', "''"))
+            }
+            WhereConfigOperator::DoesNotBeginWith => {
+                format!("\"{}\" NOT LIKE '{}%'", column, value.replace('\'', "''"))
+            }
+            WhereConfigOperator::DoesNotEndWith => {
+                format!("\"{}\" NOT LIKE '%{}'", column, value.replace('\'', "''"))
+            }
+            WhereConfigOperator::ILike => {
+                format!("\"{}\" ILIKE '{}'", column, value.replace('\'', "''"))
+            }
+            _ => {
+                // Standard operators: =, !=, <, >, <=, >=
+                format!(
+                    "\"{}\" {} '{}'",
+                    column,
+                    operator.as_str(),
+                    value.replace('\'', "''")
+                )
+            }
         }
     }