Merge branch 'main' into remove-v4-support-rules

ee/query-service/rules/anomaly.go

@@ -5,23 +5,16 @@ import (
 	"encoding/json"
 	"fmt"
 	"log/slog"
-	"math"
 	"strings"
 	"sync"
 	"time"
 
-	"github.com/SigNoz/signoz/ee/query-service/anomaly"
 	"github.com/SigNoz/signoz/pkg/cache"
-	"github.com/SigNoz/signoz/pkg/query-service/common"
 	"github.com/SigNoz/signoz/pkg/query-service/model"
-	"github.com/SigNoz/signoz/pkg/transition"
 	"github.com/SigNoz/signoz/pkg/types/ruletypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
 
-	querierV2 "github.com/SigNoz/signoz/pkg/query-service/app/querier/v2"
-	"github.com/SigNoz/signoz/pkg/query-service/app/queryBuilder"
 	"github.com/SigNoz/signoz/pkg/query-service/interfaces"
-	v3 "github.com/SigNoz/signoz/pkg/query-service/model/v3"
 	"github.com/SigNoz/signoz/pkg/query-service/utils/labels"
 	"github.com/SigNoz/signoz/pkg/query-service/utils/times"
 	"github.com/SigNoz/signoz/pkg/query-service/utils/timestamp"
@@ -32,6 +25,8 @@ import (
 
 	querierV5 "github.com/SigNoz/signoz/pkg/querier"
 
+	"github.com/SigNoz/signoz/ee/query-service/anomaly"
+
 	anomalyV2 "github.com/SigNoz/signoz/ee/anomaly"
 
 	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
@@ -48,17 +43,12 @@ type AnomalyRule struct {
 
 	reader interfaces.Reader
 
-	// querierV2 is used for alerts created after the introduction of new metrics query builder
-	querierV2 interfaces.Querier
-
-	// querierV5 is used for alerts migrated after the introduction of new query builder
+	// querierV5 is the query builder v5 querier used for all alert rule evaluation
 	querierV5 querierV5.Querier
 
-	provider   anomaly.Provider
 	providerV2 anomalyV2.Provider
 
-	version string
-	logger  *slog.Logger
+	logger *slog.Logger
 
 	seasonality anomaly.Seasonality
 }
@@ -102,34 +92,6 @@ func NewAnomalyRule(
 
 	logger.Info("using seasonality", "seasonality", t.seasonality.String())
 
-	querierOptsV2 := querierV2.QuerierOptions{
-		Reader:       reader,
-		Cache:        cache,
-		KeyGenerator: queryBuilder.NewKeyGenerator(),
-	}
-
-	t.querierV2 = querierV2.NewQuerier(querierOptsV2)
-	t.reader = reader
-	if t.seasonality == anomaly.SeasonalityHourly {
-		t.provider = anomaly.NewHourlyProvider(
-			anomaly.WithCache[*anomaly.HourlyProvider](cache),
-			anomaly.WithKeyGenerator[*anomaly.HourlyProvider](queryBuilder.NewKeyGenerator()),
-			anomaly.WithReader[*anomaly.HourlyProvider](reader),
-		)
-	} else if t.seasonality == anomaly.SeasonalityDaily {
-		t.provider = anomaly.NewDailyProvider(
-			anomaly.WithCache[*anomaly.DailyProvider](cache),
-			anomaly.WithKeyGenerator[*anomaly.DailyProvider](queryBuilder.NewKeyGenerator()),
-			anomaly.WithReader[*anomaly.DailyProvider](reader),
-		)
-	} else if t.seasonality == anomaly.SeasonalityWeekly {
-		t.provider = anomaly.NewWeeklyProvider(
-			anomaly.WithCache[*anomaly.WeeklyProvider](cache),
-			anomaly.WithKeyGenerator[*anomaly.WeeklyProvider](queryBuilder.NewKeyGenerator()),
-			anomaly.WithReader[*anomaly.WeeklyProvider](reader),
-		)
-	}
-
 	if t.seasonality == anomaly.SeasonalityHourly {
 		t.providerV2 = anomalyV2.NewHourlyProvider(
 			anomalyV2.WithQuerier[*anomalyV2.HourlyProvider](querierV5),
@@ -148,7 +110,7 @@ func NewAnomalyRule(
 	}
 
 	t.querierV5 = querierV5
-	t.version = p.Version
+	t.reader = reader
 	t.logger = logger
 	return &t, nil
 }
@@ -157,36 +119,9 @@ func (r *AnomalyRule) Type() ruletypes.RuleType {
 	return RuleTypeAnomaly
 }
 
-func (r *AnomalyRule) prepareQueryRange(ctx context.Context, ts time.Time) (*v3.QueryRangeParamsV3, error) {
+func (r *AnomalyRule) prepareQueryRange(ctx context.Context, ts time.Time) (*qbtypes.QueryRangeRequest, error) {
 
-	r.logger.InfoContext(
-		ctx, "prepare query range request v4", "ts", ts.UnixMilli(), "eval_window", r.EvalWindow().Milliseconds(), "eval_delay", r.EvalDelay().Milliseconds(),
-	)
-
-	st, en := r.Timestamps(ts)
-	start := st.UnixMilli()
-	end := en.UnixMilli()
-
-	compositeQuery := r.Condition().CompositeQuery
-
-	if compositeQuery.PanelType != v3.PanelTypeGraph {
-		compositeQuery.PanelType = v3.PanelTypeGraph
-	}
-
-	// default mode
-	return &v3.QueryRangeParamsV3{
-		Start:          start,
-		End:            end,
-		Step:           int64(math.Max(float64(common.MinAllowedStepInterval(start, end)), 60)),
-		CompositeQuery: compositeQuery,
-		Variables:      make(map[string]interface{}, 0),
-		NoCache:        false,
-	}, nil
-}
-
-func (r *AnomalyRule) prepareQueryRangeV5(ctx context.Context, ts time.Time) (*qbtypes.QueryRangeRequest, error) {
-
-	r.logger.InfoContext(ctx, "prepare query range request v5", "ts", ts.UnixMilli(), "eval_window", r.EvalWindow().Milliseconds(), "eval_delay", r.EvalDelay().Milliseconds())
+	r.logger.InfoContext(ctx, "prepare query range request", "ts", ts.UnixMilli(), "eval_window", r.EvalWindow().Milliseconds(), "eval_delay", r.EvalDelay().Milliseconds())
 
 	startTs, endTs := r.Timestamps(ts)
 	start, end := startTs.UnixMilli(), endTs.UnixMilli()
@@ -215,60 +150,6 @@ func (r *AnomalyRule) buildAndRunQuery(ctx context.Context, orgID valuer.UUID, t
 	if err != nil {
 		return nil, err
 	}
-	err = r.PopulateTemporality(ctx, orgID, params)
-	if err != nil {
-		return nil, fmt.Errorf("internal error while setting temporality")
-	}
-
-	anomalies, err := r.provider.GetAnomalies(ctx, orgID, &anomaly.GetAnomaliesRequest{
-		Params:      params,
-		Seasonality: r.seasonality,
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	var queryResult *v3.Result
-	for _, result := range anomalies.Results {
-		if result.QueryName == r.GetSelectedQuery() {
-			queryResult = result
-			break
-		}
-	}
-
-	hasData := len(queryResult.AnomalyScores) > 0
-	if missingDataAlert := r.HandleMissingDataAlert(ctx, ts, hasData); missingDataAlert != nil {
-		return ruletypes.Vector{*missingDataAlert}, nil
-	}
-
-	var resultVector ruletypes.Vector
-
-	scoresJSON, _ := json.Marshal(queryResult.AnomalyScores)
-	r.logger.InfoContext(ctx, "anomaly scores", "scores", string(scoresJSON))
-
-	for _, series := range queryResult.AnomalyScores {
-		if !r.Condition().ShouldEval(series) {
-			r.logger.InfoContext(ctx, "not enough data points to evaluate series, skipping", "ruleid", r.ID(), "numPoints", len(series.Points), "requiredPoints", r.Condition().RequiredNumPoints)
-			continue
-		}
-		results, err := r.Threshold.Eval(*series, r.Unit(), ruletypes.EvalData{
-			ActiveAlerts:  r.ActiveAlertsLabelFP(),
-			SendUnmatched: r.ShouldSendUnmatched(),
-		})
-		if err != nil {
-			return nil, err
-		}
-		resultVector = append(resultVector, results...)
-	}
-	return resultVector, nil
-}
-
-func (r *AnomalyRule) buildAndRunQueryV5(ctx context.Context, orgID valuer.UUID, ts time.Time) (ruletypes.Vector, error) {
-
-	params, err := r.prepareQueryRangeV5(ctx, ts)
-	if err != nil {
-		return nil, err
-	}
 
 	anomalies, err := r.providerV2.GetAnomalies(ctx, orgID, &anomalyV2.AnomaliesRequest{
 		Params:      *params,
@@ -290,20 +171,25 @@ func (r *AnomalyRule) buildAndRunQueryV5(ctx context.Context, orgID valuer.UUID,
 		r.logger.WarnContext(ctx, "nil qb result", "ts", ts.UnixMilli())
 	}
 
-	queryResult := transition.ConvertV5TimeSeriesDataToV4Result(qbResult)
+	var anomalyScores []*qbtypes.TimeSeries
+	if qbResult != nil {
+		for _, bucket := range qbResult.Aggregations {
+			anomalyScores = append(anomalyScores, bucket.AnomalyScores...)
+		}
+	}
 
-	hasData := len(queryResult.AnomalyScores) > 0
+	hasData := len(anomalyScores) > 0
 	if missingDataAlert := r.HandleMissingDataAlert(ctx, ts, hasData); missingDataAlert != nil {
 		return ruletypes.Vector{*missingDataAlert}, nil
 	}
 
 	var resultVector ruletypes.Vector
 
-	scoresJSON, _ := json.Marshal(queryResult.AnomalyScores)
+	scoresJSON, _ := json.Marshal(anomalyScores)
 	r.logger.InfoContext(ctx, "anomaly scores", "scores", string(scoresJSON))
 
 	// Filter out new series if newGroupEvalDelay is configured
-	seriesToProcess := queryResult.AnomalyScores
+	seriesToProcess := anomalyScores
 	if r.ShouldSkipNewGroups() {
 		filteredSeries, filterErr := r.BaseRule.FilterNewSeries(ctx, ts, seriesToProcess)
 		// In case of error we log the error and continue with the original series
@@ -316,7 +202,7 @@ func (r *AnomalyRule) buildAndRunQueryV5(ctx context.Context, orgID valuer.UUID,
 
 	for _, series := range seriesToProcess {
 		if !r.Condition().ShouldEval(series) {
-			r.logger.InfoContext(ctx, "not enough data points to evaluate series, skipping", "ruleid", r.ID(), "numPoints", len(series.Points), "requiredPoints", r.Condition().RequiredNumPoints)
+			r.logger.InfoContext(ctx, "not enough data points to evaluate series, skipping", "ruleid", r.ID(), "numPoints", len(series.Values), "requiredPoints", r.Condition().RequiredNumPoints)
 			continue
 		}
 		results, err := r.Threshold.Eval(*series, r.Unit(), ruletypes.EvalData{
@@ -337,16 +223,7 @@ func (r *AnomalyRule) Eval(ctx context.Context, ts time.Time) (int, error) {
 
 	valueFormatter := formatter.FromUnit(r.Unit())
 
-	var res ruletypes.Vector
-	var err error
-
-	if r.version == "v5" {
-		r.logger.InfoContext(ctx, "running v5 query")
-		res, err = r.buildAndRunQueryV5(ctx, r.OrgID(), ts)
-	} else {
-		r.logger.InfoContext(ctx, "running v4 query")
-		res, err = r.buildAndRunQuery(ctx, r.OrgID(), ts)
-	}
+	res, err := r.buildAndRunQuery(ctx, r.OrgID(), ts)
 	if err != nil {
 		return 0, err
 	}

ee/query-service/rules/anomaly_test.go

@@ -8,28 +8,27 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/SigNoz/signoz/ee/query-service/anomaly"
+	anomalyV2 "github.com/SigNoz/signoz/ee/anomaly"
 	"github.com/SigNoz/signoz/pkg/instrumentation/instrumentationtest"
 	"github.com/SigNoz/signoz/pkg/query-service/app/clickhouseReader"
-	v3 "github.com/SigNoz/signoz/pkg/query-service/model/v3"
 	"github.com/SigNoz/signoz/pkg/telemetrystore"
 	"github.com/SigNoz/signoz/pkg/telemetrystore/telemetrystoretest"
+	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/types/ruletypes"
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
+	v3 "github.com/SigNoz/signoz/pkg/query-service/model/v3"
 	"github.com/SigNoz/signoz/pkg/valuer"
 )
 
-// mockAnomalyProvider is a mock implementation of anomaly.Provider for testing.
-// We need this because the anomaly provider makes 6 different queries for various
-// time periods (current, past period, current season, past season, past 2 seasons,
-// past 3 seasons), making it cumbersome to create mock data.
-type mockAnomalyProvider struct {
-	responses []*anomaly.GetAnomaliesResponse
+// mockAnomalyProviderV2 is a mock implementation of anomalyV2.Provider for testing.
+type mockAnomalyProviderV2 struct {
+	responses []*anomalyV2.AnomaliesResponse
 	callCount int
 }
 
-func (m *mockAnomalyProvider) GetAnomalies(ctx context.Context, orgID valuer.UUID, req *anomaly.GetAnomaliesRequest) (*anomaly.GetAnomaliesResponse, error) {
+func (m *mockAnomalyProviderV2) GetAnomalies(ctx context.Context, orgID valuer.UUID, req *anomalyV2.AnomaliesRequest) (*anomalyV2.AnomaliesResponse, error) {
 	if m.callCount >= len(m.responses) {
-		return &anomaly.GetAnomaliesResponse{Results: []*v3.Result{}}, nil
+		return &anomalyV2.AnomaliesResponse{Results: []*qbtypes.TimeSeriesData{}}, nil
 	}
 	resp := m.responses[m.callCount]
 	m.callCount++
@@ -82,11 +81,11 @@ func TestAnomalyRule_NoData_AlertOnAbsent(t *testing.T) {
 		},
 	}
 
-	responseNoData := &anomaly.GetAnomaliesResponse{
-		Results: []*v3.Result{
+	responseNoData := &anomalyV2.AnomaliesResponse{
+		Results: []*qbtypes.TimeSeriesData{
 			{
-				QueryName:     "A",
-				AnomalyScores: []*v3.Series{},
+				QueryName:    "A",
+				Aggregations: []*qbtypes.AggregationBucket{},
 			},
 		},
 	}
@@ -129,8 +128,8 @@ func TestAnomalyRule_NoData_AlertOnAbsent(t *testing.T) {
 			)
 			require.NoError(t, err)
 
-			rule.provider = &mockAnomalyProvider{
-				responses: []*anomaly.GetAnomaliesResponse{responseNoData},
+			rule.providerV2 = &mockAnomalyProviderV2{
+				responses: []*anomalyV2.AnomaliesResponse{responseNoData},
 			}
 
 			alertsFound, err := rule.Eval(context.Background(), evalTime)
@@ -190,11 +189,11 @@ func TestAnomalyRule_NoData_AbsentFor(t *testing.T) {
 		},
 	}
 
-	responseNoData := &anomaly.GetAnomaliesResponse{
-		Results: []*v3.Result{
+	responseNoData := &anomalyV2.AnomaliesResponse{
+		Results: []*qbtypes.TimeSeriesData{
 			{
-				QueryName:     "A",
-				AnomalyScores: []*v3.Series{},
+				QueryName:    "A",
+				Aggregations: []*qbtypes.AggregationBucket{},
 			},
 		},
 	}
@@ -228,16 +227,22 @@ func TestAnomalyRule_NoData_AbsentFor(t *testing.T) {
 			t1 := baseTime.Add(5 * time.Minute)
 			t2 := t1.Add(c.timeBetweenEvals)
 
-			responseWithData := &anomaly.GetAnomaliesResponse{
-				Results: []*v3.Result{
+			responseWithData := &anomalyV2.AnomaliesResponse{
+				Results: []*qbtypes.TimeSeriesData{
 					{
 						QueryName: "A",
-						AnomalyScores: []*v3.Series{
+						Aggregations: []*qbtypes.AggregationBucket{
 							{
-								Labels: map[string]string{"test": "label"},
-								Points: []v3.Point{
-									{Timestamp: baseTime.UnixMilli(), Value: 1.0},
-									{Timestamp: baseTime.Add(time.Minute).UnixMilli(), Value: 1.5},
+								AnomalyScores: []*qbtypes.TimeSeries{
+									{
+										Labels: []*qbtypes.Label{
+											{Key: telemetrytypes.TelemetryFieldKey{Name: "test"}, Value: "label"},
+										},
+										Values: []*qbtypes.TimeSeriesValue{
+											{Timestamp: baseTime.UnixMilli(), Value: 1.0},
+											{Timestamp: baseTime.Add(time.Minute).UnixMilli(), Value: 1.5},
+										},
+									},
 								},
 							},
 						},
@@ -252,8 +257,8 @@ func TestAnomalyRule_NoData_AbsentFor(t *testing.T) {
 			rule, err := NewAnomalyRule("test-anomaly-rule", valuer.GenerateUUID(), &postableRule, reader, nil, logger, nil)
 			require.NoError(t, err)
 
-			rule.provider = &mockAnomalyProvider{
-				responses: []*anomaly.GetAnomaliesResponse{responseWithData, responseNoData},
+			rule.providerV2 = &mockAnomalyProviderV2{
+				responses: []*anomalyV2.AnomaliesResponse{responseWithData, responseNoData},
 			}
 
 			alertsFound1, err := rule.Eval(context.Background(), t1)

frontend/src/components/QuickFilters/QuickFilters.tsx

@@ -282,11 +282,11 @@ export default function QuickFilters(props: IQuickFiltersProps): JSX.Element {
 						size="small"
 						style={{ marginLeft: 'auto' }}
 						checked={showIP ?? true}
-						onClick={(): void => {
+						onChange={(checked): void => {
 							logEvent('API Monitoring: Show IP addresses clicked', {
-								showIP: !(showIP ?? true),
+								showIP: checked,
 							});
-							setParams({ showIP });
+							setParams({ showIP: checked });
 						}}
 					/>
 				</div>

frontend/src/components/QuickFilters/tests/QuickFilters.test.tsx

@@ -1,4 +1,8 @@
 import { ENVIRONMENT } from 'constants/env';
+import {
+	ApiMonitoringParams,
+	useApiMonitoringParams,
+} from 'container/ApiMonitoring/queryParams';
 import { useQueryBuilder } from 'hooks/queryBuilder/useQueryBuilder';
 import {
 	otherFiltersResponse,
@@ -18,10 +22,15 @@ import { QuickFiltersConfig } from './constants';
 jest.mock('hooks/queryBuilder/useQueryBuilder', () => ({
 	useQueryBuilder: jest.fn(),
 }));
+jest.mock('container/ApiMonitoring/queryParams');
 
 const handleFilterVisibilityChange = jest.fn();
 const redirectWithQueryBuilderData = jest.fn();
 const putHandler = jest.fn();
+const mockSetApiMonitoringParams = jest.fn() as jest.MockedFunction<
+	(newParams: Partial<ApiMonitoringParams>, replace?: boolean) => void
+>;
+const mockUseApiMonitoringParams = jest.mocked(useApiMonitoringParams);
 
 const BASE_URL = ENVIRONMENT.baseURL;
 const SIGNAL = SignalType.LOGS;
@@ -84,6 +93,28 @@ TestQuickFilters.defaultProps = {
 	config: QuickFiltersConfig,
 };
 
+function TestQuickFiltersApiMonitoring({
+	signal = SignalType.LOGS,
+	config = QuickFiltersConfig,
+}: {
+	signal?: SignalType;
+	config?: IQuickFiltersConfig[];
+}): JSX.Element {
+	return (
+		<QuickFilters
+			source={QuickFiltersSource.API_MONITORING}
+			config={config}
+			handleFilterVisibilityChange={handleFilterVisibilityChange}
+			signal={signal}
+		/>
+	);
+}
+
+TestQuickFiltersApiMonitoring.defaultProps = {
+	signal: '',
+	config: QuickFiltersConfig,
+};
+
 beforeAll(() => {
 	server.listen();
 });
@@ -112,6 +143,10 @@ beforeEach(() => {
 		lastUsedQuery: 0,
 		redirectWithQueryBuilderData,
 	});
+	mockUseApiMonitoringParams.mockReturnValue([
+		{ showIP: true } as ApiMonitoringParams,
+		mockSetApiMonitoringParams,
+	]);
 	setupServer();
 });
 
@@ -251,6 +286,24 @@ describe('Quick Filters', () => {
 			);
 		});
 	});
+	it('toggles Show IP addresses and updates API Monitoring params', async () => {
+		const user = userEvent.setup({ pointerEventsCheck: 0 });
+
+		render(<TestQuickFiltersApiMonitoring />);
+
+		// Switch should be rendered and initially checked
+		expect(screen.getByText('Show IP addresses')).toBeInTheDocument();
+		const toggle = screen.getByRole('switch');
+		expect(toggle).toHaveAttribute('aria-checked', 'true');
+
+		await user.click(toggle);
+
+		await waitFor(() => {
+			expect(mockSetApiMonitoringParams).toHaveBeenCalledWith(
+				expect.objectContaining({ showIP: false }),
+			);
+		});
+	});
 });
 
 describe('Quick Filters with custom filters', () => {

frontend/src/container/FormAlertRules/QuerySection.tsx

@@ -6,7 +6,7 @@ import logEvent from 'api/common/logEvent';
 import PromQLIcon from 'assets/Dashboard/PromQl';
 import { QueryBuilderV2 } from 'components/QueryBuilderV2/QueryBuilderV2';
 import { ALERTS_DATA_SOURCE_MAP } from 'constants/alerts';
-import { ENTITY_VERSION_V4 } from 'constants/app';
+import { ENTITY_VERSION_V5 } from 'constants/app';
 import { PANEL_TYPES } from 'constants/queryBuilder';
 import { QBShortcuts } from 'constants/shortcuts/QBShortcuts';
 import RunQueryBtn from 'container/QueryBuilder/components/RunQueryBtn/RunQueryBtn';
@@ -63,12 +63,8 @@ function QuerySection({
 				signalSource: signalSource === 'meter' ? 'meter' : '',
 			}}
 			showTraceOperator={alertType === AlertTypes.TRACES_BASED_ALERT}
-			showFunctions={
-				(alertType === AlertTypes.METRICS_BASED_ALERT &&
-					alertDef.version === ENTITY_VERSION_V4) ||
-				alertType === AlertTypes.LOGS_BASED_ALERT
-			}
-			version={alertDef.version || 'v3'}
+			showFunctions
+			version={ENTITY_VERSION_V5}
 			onSignalSourceChange={handleSignalSourceChange}
 			signalSourceChangeEnabled
 		/>

pkg/query-service/rules/base_rule.go

@@ -625,7 +625,7 @@ func (r *BaseRule) extractMetricAndGroupBys(ctx context.Context) (map[string][]s
 
 // FilterNewSeries filters out items that are too new based on metadata first_seen timestamps.
 // Returns the filtered series (old ones) excluding new series that are still within the grace period.
-func (r *BaseRule) FilterNewSeries(ctx context.Context, ts time.Time, series []*v3.Series) ([]*v3.Series, error) {
+func (r *BaseRule) FilterNewSeries(ctx context.Context, ts time.Time, series []*qbtypes.TimeSeries) ([]*qbtypes.TimeSeries, error) {
 	// Extract metric names and groupBy keys
 	metricToGroupedFields, err := r.extractMetricAndGroupBys(ctx)
 	if err != nil {
@@ -642,7 +642,7 @@ func (r *BaseRule) FilterNewSeries(ctx context.Context, ts time.Time, series []*
 	seriesIdxToLookupKeys := make(map[int][]telemetrytypes.MetricMetadataLookupKey) // series index -> lookup keys
 
 	for i := 0; i < len(series); i++ {
-		metricLabelMap := series[i].Labels
+		metricLabelMap := series[i].LabelsMap()
 
 		// Collect groupBy attribute-value pairs for this series
 		seriesKeys := make([]telemetrytypes.MetricMetadataLookupKey, 0)
@@ -689,7 +689,7 @@ func (r *BaseRule) FilterNewSeries(ctx context.Context, ts time.Time, series []*
 	}
 
 	// Filter series based on first_seen + delay
-	filteredSeries := make([]*v3.Series, 0, len(series))
+	filteredSeries := make([]*qbtypes.TimeSeries, 0, len(series))
 	evalTimeMs := ts.UnixMilli()
 	newGroupEvalDelayMs := r.newGroupEvalDelay.Milliseconds()
 
@@ -727,7 +727,7 @@ func (r *BaseRule) FilterNewSeries(ctx context.Context, ts time.Time, series []*
 		// Check if first_seen + delay has passed
 		if maxFirstSeen+newGroupEvalDelayMs > evalTimeMs {
 			// Still within grace period, skip this series
-			r.logger.InfoContext(ctx, "Skipping new series", "rule_name", r.Name(), "series_idx", i, "max_first_seen", maxFirstSeen, "eval_time_ms", evalTimeMs, "delay_ms", newGroupEvalDelayMs, "labels", series[i].Labels)
+			r.logger.InfoContext(ctx, "Skipping new series", "rule_name", r.Name(), "series_idx", i, "max_first_seen", maxFirstSeen, "eval_time_ms", evalTimeMs, "delay_ms", newGroupEvalDelayMs, "labels", series[i].LabelsMap())
 			continue
 		}
 

pkg/query-service/rules/base_rule_test.go

@@ -26,33 +26,33 @@ import (
 	"github.com/SigNoz/signoz/pkg/valuer"
 )
 
-// createTestSeries creates a *v3.Series with the given labels and optional points
+// createTestSeries creates a *qbtypes.TimeSeries with the given labels and optional values
 // so we don't exactly need the points in the series because the labels are used to determine if the series is new or old
 // we use the labels to create a lookup key for the series and then check the first_seen timestamp for the series in the metadata table
-func createTestSeries(labels map[string]string, points []v3.Point) *v3.Series {
+func createTestSeries(labels map[string]string, points []*qbtypes.TimeSeriesValue) *qbtypes.TimeSeries {
 	if points == nil {
-		points = []v3.Point{}
+		points = []*qbtypes.TimeSeriesValue{}
 	}
-	return &v3.Series{
-		Labels: labels,
-		Points: points,
+	lbls := make([]*qbtypes.Label, 0, len(labels))
+	for k, v := range labels {
+		lbls = append(lbls, &qbtypes.Label{Key: telemetrytypes.TelemetryFieldKey{Name: k}, Value: v})
+	}
+	return &qbtypes.TimeSeries{
+		Labels: lbls,
+		Values: points,
 	}
 }
 
-// seriesEqual compares two v3.Series by their labels
+// seriesEqual compares two *qbtypes.TimeSeries by their labels
 // Returns true if the series have the same labels (order doesn't matter)
-func seriesEqual(s1, s2 *v3.Series) bool {
-	if s1 == nil && s2 == nil {
-		return true
-	}
-	if s1 == nil || s2 == nil {
+func seriesEqual(s1, s2 *qbtypes.TimeSeries) bool {
+	m1 := s1.LabelsMap()
+	m2 := s2.LabelsMap()
+	if len(m1) != len(m2) {
 		return false
 	}
-	if len(s1.Labels) != len(s2.Labels) {
-		return false
-	}
-	for k, v := range s1.Labels {
-		if s2.Labels[k] != v {
+	for k, v := range m1 {
+		if m2[k] != v {
 			return false
 		}
 	}
@@ -149,11 +149,11 @@ func createPostableRule(compositeQuery *v3.CompositeQuery) ruletypes.PostableRul
 type filterNewSeriesTestCase struct {
 	name              string
 	compositeQuery    *v3.CompositeQuery
-	series            []*v3.Series
+	series            []*qbtypes.TimeSeries
 	firstSeenMap      map[telemetrytypes.MetricMetadataLookupKey]int64
 	newGroupEvalDelay valuer.TextDuration
 	evalTime          time.Time
-	expectedFiltered  []*v3.Series // series that should be in the final filtered result (old enough)
+	expectedFiltered  []*qbtypes.TimeSeries // series that should be in the final filtered result (old enough)
 	expectError       bool
 }
 
@@ -193,7 +193,7 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 					},
 				},
 			},
-			series: []*v3.Series{
+			series: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc-old", "env": "prod"}, nil),
 				createTestSeries(map[string]string{"service_name": "svc-new", "env": "prod"}, nil),
 				createTestSeries(map[string]string{"service_name": "svc-missing", "env": "stage"}, nil),
@@ -205,7 +205,7 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 			),
 			newGroupEvalDelay: defaultNewGroupEvalDelay,
 			evalTime:          defaultEvalTime,
-			expectedFiltered: []*v3.Series{
+			expectedFiltered: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc-old", "env": "prod"}, nil),
 				createTestSeries(map[string]string{"service_name": "svc-missing", "env": "stage"}, nil),
 			}, // svc-old and svc-missing should be included; svc-new is filtered out
@@ -227,7 +227,7 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 					},
 				},
 			},
-			series: []*v3.Series{
+			series: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc-new1", "env": "prod"}, nil),
 				createTestSeries(map[string]string{"service_name": "svc-new2", "env": "stage"}, nil),
 			},
@@ -237,7 +237,7 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 			),
 			newGroupEvalDelay: defaultNewGroupEvalDelay,
 			evalTime:          defaultEvalTime,
-			expectedFiltered:  []*v3.Series{}, // all should be filtered out (new series)
+			expectedFiltered:  []*qbtypes.TimeSeries{}, // all should be filtered out (new series)
 		},
 		{
 			name: "all old series - ClickHouse query",
@@ -254,7 +254,7 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 					},
 				},
 			},
-			series: []*v3.Series{
+			series: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc-old1", "env": "prod"}, nil),
 				createTestSeries(map[string]string{"service_name": "svc-old2", "env": "stage"}, nil),
 			},
@@ -264,7 +264,7 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 			),
 			newGroupEvalDelay: defaultNewGroupEvalDelay,
 			evalTime:          defaultEvalTime,
-			expectedFiltered: []*v3.Series{
+			expectedFiltered: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc-old1", "env": "prod"}, nil),
 				createTestSeries(map[string]string{"service_name": "svc-old2", "env": "stage"}, nil),
 			}, // all should be included (old series)
@@ -292,13 +292,13 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 					},
 				},
 			},
-			series: []*v3.Series{
+			series: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc1", "env": "prod"}, nil),
 			},
 			firstSeenMap:      make(map[telemetrytypes.MetricMetadataLookupKey]int64),
 			newGroupEvalDelay: defaultNewGroupEvalDelay,
 			evalTime:          defaultEvalTime,
-			expectedFiltered: []*v3.Series{
+			expectedFiltered: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc1", "env": "prod"}, nil),
 			}, // early return, no filtering - all series included
 		},
@@ -322,13 +322,13 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 					},
 				},
 			},
-			series: []*v3.Series{
+			series: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc1", "env": "prod"}, nil),
 			},
 			firstSeenMap:      make(map[telemetrytypes.MetricMetadataLookupKey]int64),
 			newGroupEvalDelay: defaultNewGroupEvalDelay,
 			evalTime:          defaultEvalTime,
-			expectedFiltered: []*v3.Series{
+			expectedFiltered: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc1", "env": "prod"}, nil),
 			}, // early return, no filtering - all series included
 		},
@@ -358,13 +358,13 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 					},
 				},
 			},
-			series: []*v3.Series{
+			series: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"status": "200"}, nil), // no service_name or env
 			},
 			firstSeenMap:      make(map[telemetrytypes.MetricMetadataLookupKey]int64),
 			newGroupEvalDelay: defaultNewGroupEvalDelay,
 			evalTime:          defaultEvalTime,
-			expectedFiltered: []*v3.Series{
+			expectedFiltered: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"status": "200"}, nil),
 			}, // series included as we can't decide if it's new or old
 		},
@@ -385,7 +385,7 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 					},
 				},
 			},
-			series: []*v3.Series{
+			series: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc-old", "env": "prod"}, nil),
 				createTestSeries(map[string]string{"service_name": "svc-no-metadata", "env": "prod"}, nil),
 			},
@@ -393,7 +393,7 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 			// svc-no-metadata has no entry in firstSeenMap
 			newGroupEvalDelay: defaultNewGroupEvalDelay,
 			evalTime:          defaultEvalTime,
-			expectedFiltered: []*v3.Series{
+			expectedFiltered: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc-old", "env": "prod"}, nil),
 				createTestSeries(map[string]string{"service_name": "svc-no-metadata", "env": "prod"}, nil),
 			}, // both should be included - svc-old is old, svc-no-metadata can't be decided
@@ -413,7 +413,7 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 					},
 				},
 			},
-			series: []*v3.Series{
+			series: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc-partial", "env": "prod"}, nil),
 			},
 			// Only provide metadata for service_name, not env
@@ -423,7 +423,7 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 			},
 			newGroupEvalDelay: defaultNewGroupEvalDelay,
 			evalTime:          defaultEvalTime,
-			expectedFiltered: []*v3.Series{
+			expectedFiltered: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc-partial", "env": "prod"}, nil),
 			}, // has some metadata, uses max first_seen which is old
 		},
@@ -453,11 +453,11 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 					},
 				},
 			},
-			series:            []*v3.Series{},
+			series:            []*qbtypes.TimeSeries{},
 			firstSeenMap:      make(map[telemetrytypes.MetricMetadataLookupKey]int64),
 			newGroupEvalDelay: defaultNewGroupEvalDelay,
 			evalTime:          defaultEvalTime,
-			expectedFiltered:  []*v3.Series{},
+			expectedFiltered:  []*qbtypes.TimeSeries{},
 		},
 		{
 			name: "zero delay - Builder",
@@ -485,13 +485,13 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 					},
 				},
 			},
-			series: []*v3.Series{
+			series: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc1", "env": "prod"}, nil),
 			},
 			firstSeenMap:      createFirstSeenMap("request_total", defaultGroupByFields, defaultEvalTime, defaultDelay, true, "svc1", "prod"),
 			newGroupEvalDelay: valuer.TextDuration{}, // zero delay
 			evalTime:          defaultEvalTime,
-			expectedFiltered: []*v3.Series{
+			expectedFiltered: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc1", "env": "prod"}, nil),
 			}, // with zero delay, all series pass
 		},
@@ -526,7 +526,7 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 					},
 				},
 			},
-			series: []*v3.Series{
+			series: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc1", "env": "prod"}, nil),
 			},
 			firstSeenMap: mergeFirstSeenMaps(
@@ -535,7 +535,7 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 			),
 			newGroupEvalDelay: defaultNewGroupEvalDelay,
 			evalTime:          defaultEvalTime,
-			expectedFiltered: []*v3.Series{
+			expectedFiltered: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc1", "env": "prod"}, nil),
 			},
 		},
@@ -565,7 +565,7 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 					},
 				},
 			},
-			series: []*v3.Series{
+			series: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc1", "env": "prod"}, nil),
 			},
 			// service_name is old, env is new - should use max (new)
@@ -575,7 +575,7 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 			),
 			newGroupEvalDelay: defaultNewGroupEvalDelay,
 			evalTime:          defaultEvalTime,
-			expectedFiltered:  []*v3.Series{}, // max first_seen is new, so should be filtered out
+			expectedFiltered:  []*qbtypes.TimeSeries{}, // max first_seen is new, so should be filtered out
 		},
 		{
 			name: "Logs query - should skip filtering and return empty skip indexes",
@@ -600,14 +600,14 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 					},
 				},
 			},
-			series: []*v3.Series{
+			series: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc1"}, nil),
 				createTestSeries(map[string]string{"service_name": "svc2"}, nil),
 			},
 			firstSeenMap:      make(map[telemetrytypes.MetricMetadataLookupKey]int64),
 			newGroupEvalDelay: defaultNewGroupEvalDelay,
 			evalTime:          defaultEvalTime,
-			expectedFiltered: []*v3.Series{
+			expectedFiltered: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc1"}, nil),
 				createTestSeries(map[string]string{"service_name": "svc2"}, nil),
 			}, // Logs queries should return early, no filtering - all included
@@ -635,14 +635,14 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 					},
 				},
 			},
-			series: []*v3.Series{
+			series: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc1"}, nil),
 				createTestSeries(map[string]string{"service_name": "svc2"}, nil),
 			},
 			firstSeenMap:      make(map[telemetrytypes.MetricMetadataLookupKey]int64),
 			newGroupEvalDelay: defaultNewGroupEvalDelay,
 			evalTime:          defaultEvalTime,
-			expectedFiltered: []*v3.Series{
+			expectedFiltered: []*qbtypes.TimeSeries{
 				createTestSeries(map[string]string{"service_name": "svc1"}, nil),
 				createTestSeries(map[string]string{"service_name": "svc2"}, nil),
 			}, // Traces queries should return early, no filtering - all included
@@ -724,14 +724,14 @@ func TestBaseRule_FilterNewSeries(t *testing.T) {
 			// Build a map to count occurrences of each unique label combination in expected series
 			expectedCounts := make(map[string]int)
 			for _, expected := range tt.expectedFiltered {
-				key := labelsKey(expected.Labels)
+				key := labelsKey(expected.LabelsMap())
 				expectedCounts[key]++
 			}
 
 			// Build a map to count occurrences of each unique label combination in filtered series
 			actualCounts := make(map[string]int)
 			for _, filtered := range filteredSeries {
-				key := labelsKey(filtered.Labels)
+				key := labelsKey(filtered.LabelsMap())
 				actualCounts[key]++
 			}
 

pkg/query-service/rules/prom_rule.go

@@ -12,19 +12,18 @@ import (
 	"github.com/SigNoz/signoz/pkg/query-service/formatter"
 	"github.com/SigNoz/signoz/pkg/query-service/interfaces"
 	"github.com/SigNoz/signoz/pkg/query-service/model"
-	v3 "github.com/SigNoz/signoz/pkg/query-service/model/v3"
 	qslabels "github.com/SigNoz/signoz/pkg/query-service/utils/labels"
 	"github.com/SigNoz/signoz/pkg/query-service/utils/times"
 	"github.com/SigNoz/signoz/pkg/query-service/utils/timestamp"
 	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/types/ruletypes"
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/prometheus/prometheus/promql"
 )
 
 type PromRule struct {
 	*BaseRule
-	version    string
 	prometheus prometheus.Prometheus
 }
 
@@ -48,7 +47,6 @@ func NewPromRule(
 
 	p := PromRule{
 		BaseRule:   baseRule,
-		version:    postableRule.Version,
 		prometheus: prometheus,
 	}
 	p.logger = logger
@@ -83,48 +81,30 @@ func (r *PromRule) GetSelectedQuery() string {
 }
 
 func (r *PromRule) getPqlQuery() (string, error) {
-	if r.version == "v5" {
-		if len(r.ruleCondition.CompositeQuery.Queries) > 0 {
-			selectedQuery := r.GetSelectedQuery()
-			for _, item := range r.ruleCondition.CompositeQuery.Queries {
-				switch item.Type {
-				case qbtypes.QueryTypePromQL:
-					promQuery, ok := item.Spec.(qbtypes.PromQuery)
-					if !ok {
-						return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid promql query spec %T", item.Spec)
-					}
-					if promQuery.Name == selectedQuery {
-						return promQuery.Query, nil
-					}
+	if len(r.ruleCondition.CompositeQuery.Queries) > 0 {
+		selectedQuery := r.GetSelectedQuery()
+		for _, item := range r.ruleCondition.CompositeQuery.Queries {
+			switch item.Type {
+			case qbtypes.QueryTypePromQL:
+				promQuery, ok := item.Spec.(qbtypes.PromQuery)
+				if !ok {
+					return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid promql query spec %T", item.Spec)
+				}
+				if promQuery.Name == selectedQuery {
+					return promQuery.Query, nil
 				}
 			}
 		}
-		return "", fmt.Errorf("invalid promql rule setup")
 	}
-
-	if r.ruleCondition.CompositeQuery.QueryType == v3.QueryTypePromQL {
-		if len(r.ruleCondition.CompositeQuery.PromQueries) > 0 {
-			selectedQuery := r.GetSelectedQuery()
-			if promQuery, ok := r.ruleCondition.CompositeQuery.PromQueries[selectedQuery]; ok {
-				query := promQuery.Query
-				if query == "" {
-					return query, fmt.Errorf("a promquery needs to be set for this rule to function")
-				}
-				return query, nil
-			}
-		}
-	}
-
-	return "", fmt.Errorf("invalid promql rule query")
+	return "", fmt.Errorf("invalid promql rule setup")
 }
 
-func (r *PromRule) matrixToV3Series(res promql.Matrix) []*v3.Series {
-	v3Series := make([]*v3.Series, 0, len(res))
+func matrixToTimeSeries(res promql.Matrix) []*qbtypes.TimeSeries {
+	result := make([]*qbtypes.TimeSeries, 0, len(res))
 	for _, series := range res {
-		commonSeries := toCommonSeries(series)
-		v3Series = append(v3Series, &commonSeries)
+		result = append(result, promSeriesToTimeSeries(series))
 	}
-	return v3Series
+	return result
 }
 
 func (r *PromRule) buildAndRunQuery(ctx context.Context, ts time.Time) (ruletypes.Vector, error) {
@@ -143,31 +123,31 @@ func (r *PromRule) buildAndRunQuery(ctx context.Context, ts time.Time) (ruletype
 		return nil, err
 	}
 
-	matrixToProcess := r.matrixToV3Series(res)
+	seriesToProcess := matrixToTimeSeries(res)
 
-	hasData := len(matrixToProcess) > 0
+	hasData := len(seriesToProcess) > 0
 	if missingDataAlert := r.HandleMissingDataAlert(ctx, ts, hasData); missingDataAlert != nil {
 		return ruletypes.Vector{*missingDataAlert}, nil
 	}
 
 	// Filter out new series if newGroupEvalDelay is configured
 	if r.ShouldSkipNewGroups() {
-		filteredSeries, filterErr := r.BaseRule.FilterNewSeries(ctx, ts, matrixToProcess)
+		filteredSeries, filterErr := r.BaseRule.FilterNewSeries(ctx, ts, seriesToProcess)
 		// In case of error we log the error and continue with the original series
 		if filterErr != nil {
 			r.logger.ErrorContext(ctx, "Error filtering new series, ", "error", filterErr, "rule_name", r.Name())
 		} else {
-			matrixToProcess = filteredSeries
+			seriesToProcess = filteredSeries
 		}
 	}
 
 	var resultVector ruletypes.Vector
 
-	for _, series := range matrixToProcess {
+	for _, series := range seriesToProcess {
 		if !r.Condition().ShouldEval(series) {
 			r.logger.InfoContext(
 				ctx, "not enough data points to evaluate series, skipping",
-				"rule_id", r.ID(), "num_points", len(series.Points), "required_points", r.Condition().RequiredNumPoints,
+				"rule_id", r.ID(), "num_points", len(series.Values), "required_points", r.Condition().RequiredNumPoints,
 			)
 			continue
 		}
@@ -454,26 +434,25 @@ func (r *PromRule) RunAlertQuery(ctx context.Context, qs string, start, end time
 	}
 }
 
-func toCommonSeries(series promql.Series) v3.Series {
-	commonSeries := v3.Series{
-		Labels:      make(map[string]string),
-		LabelsArray: make([]map[string]string, 0),
-		Points:      make([]v3.Point, 0),
+func promSeriesToTimeSeries(series promql.Series) *qbtypes.TimeSeries {
+	ts := &qbtypes.TimeSeries{
+		Labels: make([]*qbtypes.Label, 0, len(series.Metric)),
+		Values: make([]*qbtypes.TimeSeriesValue, 0, len(series.Floats)),
 	}
 
 	for _, lbl := range series.Metric {
-		commonSeries.Labels[lbl.Name] = lbl.Value
-		commonSeries.LabelsArray = append(commonSeries.LabelsArray, map[string]string{
-			lbl.Name: lbl.Value,
+		ts.Labels = append(ts.Labels, &qbtypes.Label{
+			Key:   telemetrytypes.TelemetryFieldKey{Name: lbl.Name},
+			Value: lbl.Value,
 		})
 	}
 
 	for _, f := range series.Floats {
-		commonSeries.Points = append(commonSeries.Points, v3.Point{
+		ts.Values = append(ts.Values, &qbtypes.TimeSeriesValue{
 			Timestamp: f.T,
 			Value:     f.F,
 		})
 	}
 
-	return commonSeries
+	return ts
 }

pkg/query-service/rules/prom_rule_test.go

@@ -20,6 +20,7 @@ import (
 	qslabels "github.com/SigNoz/signoz/pkg/query-service/utils/labels"
 	"github.com/SigNoz/signoz/pkg/telemetrystore"
 	"github.com/SigNoz/signoz/pkg/telemetrystore/telemetrystoretest"
+	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/types/ruletypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
 )
@@ -47,9 +48,13 @@ func TestPromRuleEval(t *testing.T) {
 		RuleCondition: &ruletypes.RuleCondition{
 			CompositeQuery: &v3.CompositeQuery{
 				QueryType: v3.QueryTypePromQL,
-				PromQueries: map[string]*v3.PromQuery{
-					"A": {
-						Query: "dummy_query", // This is not used in the test
+				Queries: []qbtypes.QueryEnvelope{
+					{
+						Type: qbtypes.QueryTypePromQL,
+						Spec: qbtypes.PromQuery{
+							Name:  "A",
+							Query: "dummy_query", // This is not used in the test
+						},
 					},
 				},
 			},
@@ -62,7 +67,7 @@ func TestPromRuleEval(t *testing.T) {
 		compareOp            string
 		matchType            string
 		target               float64
-		expectedAlertSample  v3.Point
+		expectedAlertSample  float64
 		expectedVectorValues []float64 // Expected values in result vector
 	}{
 		// Test cases for Equals Always
@@ -80,7 +85,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:            "3", // Equals
 			matchType:            "2", // Always
 			target:               0.0,
-			expectedAlertSample:  v3.Point{Value: 0.0},
+			expectedAlertSample:  0.0,
 			expectedVectorValues: []float64{0.0},
 		},
 		{
@@ -145,7 +150,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:            "3", // Equals
 			matchType:            "1", // Once
 			target:               0.0,
-			expectedAlertSample:  v3.Point{Value: 0.0},
+			expectedAlertSample:  0.0,
 			expectedVectorValues: []float64{0.0},
 		},
 		{
@@ -162,7 +167,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:           "3", // Equals
 			matchType:           "1", // Once
 			target:              0.0,
-			expectedAlertSample: v3.Point{Value: 0.0},
+			expectedAlertSample: 0.0,
 		},
 		{
 			values: pql.Series{
@@ -178,7 +183,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:           "3", // Equals
 			matchType:           "1", // Once
 			target:              0.0,
-			expectedAlertSample: v3.Point{Value: 0.0},
+			expectedAlertSample: 0.0,
 		},
 		{
 			values: pql.Series{
@@ -211,7 +216,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:            "1", // Greater Than
 			matchType:            "2", // Always
 			target:               1.5,
-			expectedAlertSample:  v3.Point{Value: 2.0},
+			expectedAlertSample:  2.0,
 			expectedVectorValues: []float64{2.0},
 		},
 		{
@@ -228,7 +233,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:           "1", // Above
 			matchType:           "2", // Always
 			target:              2.0,
-			expectedAlertSample: v3.Point{Value: 3.0},
+			expectedAlertSample: 3.0,
 		},
 		{
 			values: pql.Series{
@@ -244,7 +249,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:           "2", // Below
 			matchType:           "2", // Always
 			target:              13.0,
-			expectedAlertSample: v3.Point{Value: 12.0},
+			expectedAlertSample: 12.0,
 		},
 		{
 			values: pql.Series{
@@ -276,7 +281,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:            "1", // Greater Than
 			matchType:            "1", // Once
 			target:               4.5,
-			expectedAlertSample:  v3.Point{Value: 10.0},
+			expectedAlertSample:  10.0,
 			expectedVectorValues: []float64{10.0},
 		},
 		{
@@ -339,7 +344,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:           "4", // Not Equals
 			matchType:           "2", // Always
 			target:              0.0,
-			expectedAlertSample: v3.Point{Value: 1.0},
+			expectedAlertSample: 1.0,
 		},
 		{
 			values: pql.Series{
@@ -371,7 +376,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:           "4", // Not Equals
 			matchType:           "1", // Once
 			target:              0.0,
-			expectedAlertSample: v3.Point{Value: 1.0},
+			expectedAlertSample: 1.0,
 		},
 		{
 			values: pql.Series{
@@ -402,7 +407,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:           "4", // Not Equals
 			matchType:           "1", // Once
 			target:              0.0,
-			expectedAlertSample: v3.Point{Value: 1.0},
+			expectedAlertSample: 1.0,
 		},
 		{
 			values: pql.Series{
@@ -418,7 +423,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:           "4", // Not Equals
 			matchType:           "1", // Once
 			target:              0.0,
-			expectedAlertSample: v3.Point{Value: 1.0},
+			expectedAlertSample: 1.0,
 		},
 		// Test cases for Less Than Always
 		{
@@ -435,7 +440,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:           "2", // Less Than
 			matchType:           "2", // Always
 			target:              4,
-			expectedAlertSample: v3.Point{Value: 1.5},
+			expectedAlertSample: 1.5,
 		},
 		{
 			values: pql.Series{
@@ -467,7 +472,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:           "2", // Less Than
 			matchType:           "1", // Once
 			target:              4,
-			expectedAlertSample: v3.Point{Value: 2.5},
+			expectedAlertSample: 2.5,
 		},
 		{
 			values: pql.Series{
@@ -499,7 +504,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:           "3", // Equals
 			matchType:           "3", // OnAverage
 			target:              6.0,
-			expectedAlertSample: v3.Point{Value: 6.0},
+			expectedAlertSample: 6.0,
 		},
 		{
 			values: pql.Series{
@@ -530,7 +535,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:           "4", // Not Equals
 			matchType:           "3", // OnAverage
 			target:              4.5,
-			expectedAlertSample: v3.Point{Value: 6.0},
+			expectedAlertSample: 6.0,
 		},
 		{
 			values: pql.Series{
@@ -561,7 +566,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:           "1", // Greater Than
 			matchType:           "3", // OnAverage
 			target:              4.5,
-			expectedAlertSample: v3.Point{Value: 6.0},
+			expectedAlertSample: 6.0,
 		},
 		{
 			values: pql.Series{
@@ -577,7 +582,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:           "2", // Less Than
 			matchType:           "3", // OnAverage
 			target:              12.0,
-			expectedAlertSample: v3.Point{Value: 6.0},
+			expectedAlertSample: 6.0,
 		},
 		// Test cases for InTotal
 		{
@@ -594,7 +599,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:           "3", // Equals
 			matchType:           "4", // InTotal
 			target:              30.0,
-			expectedAlertSample: v3.Point{Value: 30.0},
+			expectedAlertSample: 30.0,
 		},
 		{
 			values: pql.Series{
@@ -621,7 +626,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:           "4", // Not Equals
 			matchType:           "4", // InTotal
 			target:              9.0,
-			expectedAlertSample: v3.Point{Value: 10.0},
+			expectedAlertSample: 10.0,
 		},
 		{
 			values: pql.Series{
@@ -645,7 +650,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:           "1", // Greater Than
 			matchType:           "4", // InTotal
 			target:              10.0,
-			expectedAlertSample: v3.Point{Value: 20.0},
+			expectedAlertSample: 20.0,
 		},
 		{
 			values: pql.Series{
@@ -670,7 +675,7 @@ func TestPromRuleEval(t *testing.T) {
 			compareOp:           "2", // Less Than
 			matchType:           "4", // InTotal
 			target:              30.0,
-			expectedAlertSample: v3.Point{Value: 20.0},
+			expectedAlertSample: 20.0,
 		},
 		{
 			values: pql.Series{
@@ -708,7 +713,7 @@ func TestPromRuleEval(t *testing.T) {
 			assert.NoError(t, err)
 		}
 
-		resultVectors, err := rule.Threshold.Eval(toCommonSeries(c.values), rule.Unit(), ruletypes.EvalData{})
+		resultVectors, err := rule.Threshold.Eval(*promSeriesToTimeSeries(c.values), rule.Unit(), ruletypes.EvalData{})
 		assert.NoError(t, err)
 
 		// Compare full result vector with expected vector
@@ -724,12 +729,12 @@ func TestPromRuleEval(t *testing.T) {
 				if len(resultVectors) > 0 {
 					found := false
 					for _, sample := range resultVectors {
-						if sample.V == c.expectedAlertSample.Value {
+						if sample.V == c.expectedAlertSample {
 							found = true
 							break
 						}
 					}
-					assert.True(t, found, "Expected alert sample value %.2f not found in result vectors for case %d. Got values: %v", c.expectedAlertSample.Value, idx, actualValues)
+					assert.True(t, found, "Expected alert sample value %.2f not found in result vectors for case %d. Got values: %v", c.expectedAlertSample, idx, actualValues)
 				}
 			} else {
 				assert.Empty(t, resultVectors, "Expected no alert but got result vectors for case %d", idx)
@@ -754,9 +759,13 @@ func TestPromRuleUnitCombinations(t *testing.T) {
 		RuleCondition: &ruletypes.RuleCondition{
 			CompositeQuery: &v3.CompositeQuery{
 				QueryType: v3.QueryTypePromQL,
-				PromQueries: map[string]*v3.PromQuery{
-					"A": {
-						Query: "test_metric",
+				Queries: []qbtypes.QueryEnvelope{
+					{
+						Type: qbtypes.QueryTypePromQL,
+						Spec: qbtypes.PromQuery{
+							Name:  "A",
+							Query: "test_metric",
+						},
 					},
 				},
 			},
@@ -1013,9 +1022,13 @@ func _Enable_this_after_9146_issue_fix_is_merged_TestPromRuleNoData(t *testing.T
 		RuleCondition: &ruletypes.RuleCondition{
 			CompositeQuery: &v3.CompositeQuery{
 				QueryType: v3.QueryTypePromQL,
-				PromQueries: map[string]*v3.PromQuery{
-					"A": {
-						Query: "test_metric",
+				Queries: []qbtypes.QueryEnvelope{
+					{
+						Type: qbtypes.QueryTypePromQL,
+						Spec: qbtypes.PromQuery{
+							Name:  "A",
+							Query: "test_metric",
+						},
 					},
 				},
 			},
@@ -1124,9 +1137,13 @@ func TestMultipleThresholdPromRule(t *testing.T) {
 		RuleCondition: &ruletypes.RuleCondition{
 			CompositeQuery: &v3.CompositeQuery{
 				QueryType: v3.QueryTypePromQL,
-				PromQueries: map[string]*v3.PromQuery{
-					"A": {
-						Query: "test_metric",
+				Queries: []qbtypes.QueryEnvelope{
+					{
+						Type: qbtypes.QueryTypePromQL,
+						Spec: qbtypes.PromQuery{
+							Name:  "A",
+							Query: "test_metric",
+						},
 					},
 				},
 			},
@@ -1361,8 +1378,11 @@ func TestPromRule_NoData(t *testing.T) {
 			MatchType: ruletypes.AtleastOnce,
 			CompositeQuery: &v3.CompositeQuery{
 				QueryType: v3.QueryTypePromQL,
-				PromQueries: map[string]*v3.PromQuery{
-					"A": {Query: "test_metric"},
+				Queries: []qbtypes.QueryEnvelope{
+					{
+						Type: qbtypes.QueryTypePromQL,
+						Spec: qbtypes.PromQuery{Name: "A", Query: "test_metric"},
+					},
 				},
 			},
 			Thresholds: &ruletypes.RuleThresholdData{
@@ -1486,8 +1506,11 @@ func TestPromRule_NoData_AbsentFor(t *testing.T) {
 			Target:        &target,
 			CompositeQuery: &v3.CompositeQuery{
 				QueryType: v3.QueryTypePromQL,
-				PromQueries: map[string]*v3.PromQuery{
-					"A": {Query: "test_metric"},
+				Queries: []qbtypes.QueryEnvelope{
+					{
+						Type: qbtypes.QueryTypePromQL,
+						Spec: qbtypes.PromQuery{Name: "A", Query: "test_metric"},
+					},
 				},
 			},
 			Thresholds: &ruletypes.RuleThresholdData{
@@ -1635,8 +1658,11 @@ func TestPromRuleEval_RequireMinPoints(t *testing.T) {
 			MatchType: ruletypes.AtleastOnce,
 			CompositeQuery: &v3.CompositeQuery{
 				QueryType: v3.QueryTypePromQL,
-				PromQueries: map[string]*v3.PromQuery{
-					"A": {Query: "test_metric"},
+				Queries: []qbtypes.QueryEnvelope{
+					{
+						Type: qbtypes.QueryTypePromQL,
+						Spec: qbtypes.PromQuery{Name: "A", Query: "test_metric"},
+					},
 				},
 			},
 		},

pkg/query-service/rules/threshold_rule.go

@@ -1,38 +1,24 @@
 package rules
 
 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
 	"log/slog"
-	"math"
 	"net/url"
-	"reflect"
-	"text/template"
 	"time"
 
 	"github.com/SigNoz/signoz/pkg/contextlinks"
-	"github.com/SigNoz/signoz/pkg/query-service/common"
 	"github.com/SigNoz/signoz/pkg/query-service/model"
-	"github.com/SigNoz/signoz/pkg/query-service/postprocess"
-	"github.com/SigNoz/signoz/pkg/transition"
 	"github.com/SigNoz/signoz/pkg/types/ruletypes"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
 
-	"github.com/SigNoz/signoz/pkg/query-service/app/querier"
-	querierV2 "github.com/SigNoz/signoz/pkg/query-service/app/querier/v2"
-	"github.com/SigNoz/signoz/pkg/query-service/app/queryBuilder"
 	"github.com/SigNoz/signoz/pkg/query-service/interfaces"
-	v3 "github.com/SigNoz/signoz/pkg/query-service/model/v3"
 	"github.com/SigNoz/signoz/pkg/query-service/utils/labels"
-	querytemplate "github.com/SigNoz/signoz/pkg/query-service/utils/queryTemplate"
 	"github.com/SigNoz/signoz/pkg/query-service/utils/times"
 	"github.com/SigNoz/signoz/pkg/query-service/utils/timestamp"
 
-	logsv3 "github.com/SigNoz/signoz/pkg/query-service/app/logs/v3"
-	tracesV4 "github.com/SigNoz/signoz/pkg/query-service/app/traces/v4"
 	"github.com/SigNoz/signoz/pkg/query-service/formatter"
 
 	querierV5 "github.com/SigNoz/signoz/pkg/querier"
@@ -42,23 +28,9 @@ import (
 
 type ThresholdRule struct {
 	*BaseRule
-	// Ever since we introduced the new metrics query builder, the version is "v4"
-	// for all the rules
-	// if the version is "v3", then we use the old querier
-	// if the version is "v4", then we use the new querierV2
-	version string
 
-	// querier is used for alerts created before the introduction of new metrics query builder
-	querier interfaces.Querier
-	// querierV2 is used for alerts created after the introduction of new metrics query builder
-	querierV2 interfaces.Querier
-
-	// querierV5 is used for alerts migrated after the introduction of new query builder
+	// querierV5 is the query builder v5 querier used for all alert rule evaluation
 	querierV5 querierV5.Querier
-
-	// used for attribute metadata enrichment for logs and traces
-	logsKeys  map[string]v3.AttributeKey
-	spansKeys map[string]v3.AttributeKey
 }
 
 var _ Rule = (*ThresholdRule)(nil)
@@ -82,25 +54,10 @@ func NewThresholdRule(
 	}
 
 	t := ThresholdRule{
-		BaseRule: baseRule,
-		version:  p.Version,
+		BaseRule:   baseRule,
+		querierV5: querierV5,
 	}
 
-	querierOption := querier.QuerierOptions{
-		Reader:       reader,
-		Cache:        nil,
-		KeyGenerator: queryBuilder.NewKeyGenerator(),
-	}
-
-	querierOptsV2 := querierV2.QuerierOptions{
-		Reader:       reader,
-		Cache:        nil,
-		KeyGenerator: queryBuilder.NewKeyGenerator(),
-	}
-
-	t.querier = querier.NewQuerier(querierOption)
-	t.querierV2 = querierV2.NewQuerier(querierOptsV2)
-	t.querierV5 = querierV5
 	t.reader = reader
 	return &t, nil
 }
@@ -120,169 +77,9 @@ func (r *ThresholdRule) Type() ruletypes.RuleType {
 	return ruletypes.RuleTypeThreshold
 }
 
-func (r *ThresholdRule) prepareQueryRange(ctx context.Context, ts time.Time) (*v3.QueryRangeParamsV3, error) {
+func (r *ThresholdRule) prepareQueryRange(ctx context.Context, ts time.Time) (*qbtypes.QueryRangeRequest, error) {
 	r.logger.InfoContext(
-		ctx, "prepare query range request v4", "ts", ts.UnixMilli(), "eval_window", r.evalWindow.Milliseconds(), "eval_delay", r.evalDelay.Milliseconds(),
-	)
-
-	startTs, endTs := r.Timestamps(ts)
-	start, end := startTs.UnixMilli(), endTs.UnixMilli()
-
-	if r.ruleCondition.QueryType() == v3.QueryTypeClickHouseSQL {
-		params := &v3.QueryRangeParamsV3{
-			Start: start,
-			End:   end,
-			Step:  int64(math.Max(float64(common.MinAllowedStepInterval(start, end)), 60)),
-			CompositeQuery: &v3.CompositeQuery{
-				QueryType:         r.ruleCondition.CompositeQuery.QueryType,
-				PanelType:         r.ruleCondition.CompositeQuery.PanelType,
-				BuilderQueries:    make(map[string]*v3.BuilderQuery),
-				ClickHouseQueries: make(map[string]*v3.ClickHouseQuery),
-				PromQueries:       make(map[string]*v3.PromQuery),
-				Unit:              r.ruleCondition.CompositeQuery.Unit,
-			},
-			Variables: make(map[string]interface{}),
-			NoCache:   true,
-		}
-		querytemplate.AssignReservedVarsV3(params)
-		for name, chQuery := range r.ruleCondition.CompositeQuery.ClickHouseQueries {
-			if chQuery.Disabled {
-				continue
-			}
-			tmpl := template.New("clickhouse-query")
-			tmpl, err := tmpl.Parse(chQuery.Query)
-			if err != nil {
-				return nil, err
-			}
-			var query bytes.Buffer
-			err = tmpl.Execute(&query, params.Variables)
-			if err != nil {
-				return nil, err
-			}
-			params.CompositeQuery.ClickHouseQueries[name] = &v3.ClickHouseQuery{
-				Query:    query.String(),
-				Disabled: chQuery.Disabled,
-				Legend:   chQuery.Legend,
-			}
-		}
-		return params, nil
-	}
-
-	if r.ruleCondition.CompositeQuery != nil && r.ruleCondition.CompositeQuery.BuilderQueries != nil {
-		for _, q := range r.ruleCondition.CompositeQuery.BuilderQueries {
-			// If the step interval is less than the minimum allowed step interval, set it to the minimum allowed step interval
-			if minStep := common.MinAllowedStepInterval(start, end); q.StepInterval < minStep {
-				q.StepInterval = minStep
-			}
-
-			q.SetShiftByFromFunc()
-
-			if q.DataSource == v3.DataSourceMetrics {
-				// if the time range is greater than 1 day, and less than 1 week set the step interval to be multiple of 5 minutes
-				// if the time range is greater than 1 week, set the step interval to be multiple of 30 mins
-				if end-start >= 24*time.Hour.Milliseconds() && end-start < 7*24*time.Hour.Milliseconds() {
-					q.StepInterval = int64(math.Round(float64(q.StepInterval)/300)) * 300
-				} else if end-start >= 7*24*time.Hour.Milliseconds() {
-					q.StepInterval = int64(math.Round(float64(q.StepInterval)/1800)) * 1800
-				}
-			}
-		}
-	}
-
-	if r.ruleCondition.CompositeQuery.PanelType != v3.PanelTypeGraph {
-		r.ruleCondition.CompositeQuery.PanelType = v3.PanelTypeGraph
-	}
-
-	// default mode
-	return &v3.QueryRangeParamsV3{
-		Start:          start,
-		End:            end,
-		Step:           int64(math.Max(float64(common.MinAllowedStepInterval(start, end)), 60)),
-		CompositeQuery: r.ruleCondition.CompositeQuery,
-		Variables:      make(map[string]interface{}),
-		NoCache:        true,
-	}, nil
-}
-
-func (r *ThresholdRule) prepareLinksToLogs(ctx context.Context, ts time.Time, lbls labels.Labels) string {
-	if r.version == "v5" {
-		return r.prepareLinksToLogsV5(ctx, ts, lbls)
-	}
-
-	selectedQuery := r.GetSelectedQuery()
-
-	qr, err := r.prepareQueryRange(ctx, ts)
-	if err != nil {
-		return ""
-	}
-	start := time.UnixMilli(qr.Start)
-	end := time.UnixMilli(qr.End)
-
-	// TODO(srikanthccv): handle formula queries
-	if selectedQuery < "A" || selectedQuery > "Z" {
-		return ""
-	}
-
-	q := r.ruleCondition.CompositeQuery.BuilderQueries[selectedQuery]
-	if q == nil {
-		return ""
-	}
-
-	if q.DataSource != v3.DataSourceLogs {
-		return ""
-	}
-
-	queryFilter := []v3.FilterItem{}
-	if q.Filters != nil {
-		queryFilter = q.Filters.Items
-	}
-
-	filterItems := contextlinks.PrepareFilters(lbls.Map(), queryFilter, q.GroupBy, r.logsKeys)
-
-	return contextlinks.PrepareLinksToLogs(start, end, filterItems)
-}
-
-func (r *ThresholdRule) prepareLinksToTraces(ctx context.Context, ts time.Time, lbls labels.Labels) string {
-	if r.version == "v5" {
-		return r.prepareLinksToTracesV5(ctx, ts, lbls)
-	}
-
-	selectedQuery := r.GetSelectedQuery()
-
-	qr, err := r.prepareQueryRange(ctx, ts)
-	if err != nil {
-		return ""
-	}
-	start := time.UnixMilli(qr.Start)
-	end := time.UnixMilli(qr.End)
-
-	// TODO(srikanthccv): handle formula queries
-	if selectedQuery < "A" || selectedQuery > "Z" {
-		return ""
-	}
-
-	q := r.ruleCondition.CompositeQuery.BuilderQueries[selectedQuery]
-	if q == nil {
-		return ""
-	}
-
-	if q.DataSource != v3.DataSourceTraces {
-		return ""
-	}
-
-	queryFilter := []v3.FilterItem{}
-	if q.Filters != nil {
-		queryFilter = q.Filters.Items
-	}
-
-	filterItems := contextlinks.PrepareFilters(lbls.Map(), queryFilter, q.GroupBy, r.spansKeys)
-
-	return contextlinks.PrepareLinksToTraces(start, end, filterItems)
-}
-
-func (r *ThresholdRule) prepareQueryRangeV5(ctx context.Context, ts time.Time) (*qbtypes.QueryRangeRequest, error) {
-	r.logger.InfoContext(
-		ctx, "prepare query range request v5", "ts", ts.UnixMilli(), "eval_window", r.evalWindow.Milliseconds(), "eval_delay", r.evalDelay.Milliseconds(),
+		ctx, "prepare query range request", "ts", ts.UnixMilli(), "eval_window", r.evalWindow.Milliseconds(), "eval_delay", r.evalDelay.Milliseconds(),
 	)
 
 	startTs, endTs := r.Timestamps(ts)
@@ -302,10 +99,10 @@ func (r *ThresholdRule) prepareQueryRangeV5(ctx context.Context, ts time.Time) (
 	return req, nil
 }
 
-func (r *ThresholdRule) prepareLinksToLogsV5(ctx context.Context, ts time.Time, lbls labels.Labels) string {
+func (r *ThresholdRule) prepareLinksToLogs(ctx context.Context, ts time.Time, lbls labels.Labels) string {
 	selectedQuery := r.GetSelectedQuery()
 
-	qr, err := r.prepareQueryRangeV5(ctx, ts)
+	qr, err := r.prepareQueryRange(ctx, ts)
 	if err != nil {
 		return ""
 	}
@@ -342,10 +139,10 @@ func (r *ThresholdRule) prepareLinksToLogsV5(ctx context.Context, ts time.Time,
 	return contextlinks.PrepareLinksToLogsV5(start, end, whereClause)
 }
 
-func (r *ThresholdRule) prepareLinksToTracesV5(ctx context.Context, ts time.Time, lbls labels.Labels) string {
+func (r *ThresholdRule) prepareLinksToTraces(ctx context.Context, ts time.Time, lbls labels.Labels) string {
 	selectedQuery := r.GetSelectedQuery()
 
-	qr, err := r.prepareQueryRangeV5(ctx, ts)
+	qr, err := r.prepareQueryRange(ctx, ts)
 	if err != nil {
 		return ""
 	}
@@ -391,115 +188,6 @@ func (r *ThresholdRule) buildAndRunQuery(ctx context.Context, orgID valuer.UUID,
 	if err != nil {
 		return nil, err
 	}
-	err = r.PopulateTemporality(ctx, orgID, params)
-	if err != nil {
-		return nil, fmt.Errorf("internal error while setting temporality")
-	}
-
-	if params.CompositeQuery.QueryType == v3.QueryTypeBuilder {
-		hasLogsQuery := false
-		hasTracesQuery := false
-		for _, query := range params.CompositeQuery.BuilderQueries {
-			if query.DataSource == v3.DataSourceLogs {
-				hasLogsQuery = true
-			}
-			if query.DataSource == v3.DataSourceTraces {
-				hasTracesQuery = true
-			}
-		}
-
-		if hasLogsQuery {
-			// check if any enrichment is required for logs if yes then enrich them
-			if logsv3.EnrichmentRequired(params) {
-				logsFields, apiErr := r.reader.GetLogFieldsFromNames(ctx, logsv3.GetFieldNames(params.CompositeQuery))
-				if apiErr != nil {
-					return nil, apiErr.ToError()
-				}
-				logsKeys := model.GetLogFieldsV3(ctx, params, logsFields)
-				r.logsKeys = logsKeys
-				logsv3.Enrich(params, logsKeys)
-			}
-		}
-
-		if hasTracesQuery {
-			spanKeys, err := r.reader.GetSpanAttributeKeysByNames(ctx, logsv3.GetFieldNames(params.CompositeQuery))
-			if err != nil {
-				return nil, err
-			}
-			r.spansKeys = spanKeys
-			tracesV4.Enrich(params, spanKeys)
-		}
-	}
-
-	var results []*v3.Result
-	var queryErrors map[string]error
-
-	if r.version == "v4" {
-		results, queryErrors, err = r.querierV2.QueryRange(ctx, orgID, params)
-	} else {
-		results, queryErrors, err = r.querier.QueryRange(ctx, orgID, params)
-	}
-
-	if err != nil {
-		r.logger.ErrorContext(ctx, "failed to get alert query range result", "rule_name", r.Name(), "error", err, "query_errors", queryErrors)
-		return nil, fmt.Errorf("internal error while querying")
-	}
-
-	if params.CompositeQuery.QueryType == v3.QueryTypeBuilder {
-		results, err = postprocess.PostProcessResult(results, params)
-		if err != nil {
-			r.logger.ErrorContext(ctx, "failed to post process result", "rule_name", r.Name(), "error", err)
-			return nil, fmt.Errorf("internal error while post processing")
-		}
-	}
-
-	selectedQuery := r.GetSelectedQuery()
-
-	var queryResult *v3.Result
-	for _, res := range results {
-		if res.QueryName == selectedQuery {
-			queryResult = res
-			break
-		}
-	}
-
-	hasData := queryResult != nil && len(queryResult.Series) > 0
-	if missingDataAlert := r.HandleMissingDataAlert(ctx, ts, hasData); missingDataAlert != nil {
-		return ruletypes.Vector{*missingDataAlert}, nil
-	}
-
-	var resultVector ruletypes.Vector
-
-	if queryResult == nil {
-		r.logger.WarnContext(ctx, "query result is nil", "rule_name", r.Name(), "query_name", selectedQuery)
-		return resultVector, nil
-	}
-
-	for _, series := range queryResult.Series {
-		if !r.Condition().ShouldEval(series) {
-			r.logger.InfoContext(ctx, "not enough data points to evaluate series, skipping", "ruleid", r.ID(), "numPoints", len(series.Points), "requiredPoints", r.Condition().RequiredNumPoints)
-			continue
-		}
-		resultSeries, err := r.Threshold.Eval(*series, r.Unit(), ruletypes.EvalData{
-			ActiveAlerts:  r.ActiveAlertsLabelFP(),
-			SendUnmatched: r.ShouldSendUnmatched(),
-		})
-		if err != nil {
-			return nil, err
-		}
-		resultVector = append(resultVector, resultSeries...)
-	}
-
-	return resultVector, nil
-}
-
-func (r *ThresholdRule) buildAndRunQueryV5(ctx context.Context, orgID valuer.UUID, ts time.Time) (ruletypes.Vector, error) {
-	params, err := r.prepareQueryRangeV5(ctx, ts)
-	if err != nil {
-		return nil, err
-	}
-
-	var results []*v3.Result
 
 	v5Result, err := r.querierV5.QueryRange(ctx, orgID, params)
 	if err != nil {
@@ -507,26 +195,24 @@ func (r *ThresholdRule) buildAndRunQueryV5(ctx context.Context, orgID valuer.UUI
 		return nil, fmt.Errorf("internal error while querying")
 	}
 
-	for _, item := range v5Result.Data.Results {
-		if tsData, ok := item.(*qbtypes.TimeSeriesData); ok {
-			results = append(results, transition.ConvertV5TimeSeriesDataToV4Result(tsData))
-		} else {
-			// NOTE: should not happen but just to ensure we don't miss it if it happens for some reason
-			r.logger.WarnContext(ctx, "expected qbtypes.TimeSeriesData but got", "item_type", reflect.TypeOf(item))
-		}
-	}
-
 	selectedQuery := r.GetSelectedQuery()
 
-	var queryResult *v3.Result
-	for _, res := range results {
-		if res.QueryName == selectedQuery {
-			queryResult = res
+	var queryResult *qbtypes.TimeSeriesData
+	for _, item := range v5Result.Data.Results {
+		if tsData, ok := item.(*qbtypes.TimeSeriesData); ok && tsData.QueryName == selectedQuery {
+			queryResult = tsData
 			break
 		}
 	}
 
-	hasData := queryResult != nil && len(queryResult.Series) > 0
+	var allSeries []*qbtypes.TimeSeries
+	if queryResult != nil {
+		for _, bucket := range queryResult.Aggregations {
+			allSeries = append(allSeries, bucket.Series...)
+		}
+	}
+
+	hasData := len(allSeries) > 0
 	if missingDataAlert := r.HandleMissingDataAlert(ctx, ts, hasData); missingDataAlert != nil {
 		return ruletypes.Vector{*missingDataAlert}, nil
 	}
@@ -539,7 +225,7 @@ func (r *ThresholdRule) buildAndRunQueryV5(ctx context.Context, orgID valuer.UUI
 	}
 
 	// Filter out new series if newGroupEvalDelay is configured
-	seriesToProcess := queryResult.Series
+	seriesToProcess := allSeries
 	if r.ShouldSkipNewGroups() {
 		filteredSeries, filterErr := r.BaseRule.FilterNewSeries(ctx, ts, seriesToProcess)
 		// In case of error we log the error and continue with the original series
@@ -552,7 +238,7 @@ func (r *ThresholdRule) buildAndRunQueryV5(ctx context.Context, orgID valuer.UUI
 
 	for _, series := range seriesToProcess {
 		if !r.Condition().ShouldEval(series) {
-			r.logger.InfoContext(ctx, "not enough data points to evaluate series, skipping", "ruleid", r.ID(), "numPoints", len(series.Points), "requiredPoints", r.Condition().RequiredNumPoints)
+			r.logger.InfoContext(ctx, "not enough data points to evaluate series, skipping", "ruleid", r.ID(), "numPoints", len(series.Values), "requiredPoints", r.Condition().RequiredNumPoints)
 			continue
 		}
 		resultSeries, err := r.Threshold.Eval(*series, r.Unit(), ruletypes.EvalData{
@@ -573,16 +259,7 @@ func (r *ThresholdRule) Eval(ctx context.Context, ts time.Time) (int, error) {
 
 	valueFormatter := formatter.FromUnit(r.Unit())
 
-	var res ruletypes.Vector
-	var err error
-
-	if r.version == "v5" {
-		r.logger.InfoContext(ctx, "running v5 query")
-		res, err = r.buildAndRunQueryV5(ctx, r.orgID, ts)
-	} else {
-		r.logger.InfoContext(ctx, "running v4 query")
-		res, err = r.buildAndRunQuery(ctx, r.orgID, ts)
-	}
+	res, err := r.buildAndRunQuery(ctx, r.orgID, ts)
 
 	if err != nil {
 		return 0, err

pkg/signoz/provider.go

@@ -167,6 +167,7 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewMigrateRbacToAuthzFactory(sqlstore),
 		sqlmigration.NewMigratePublicDashboardsFactory(sqlstore),
 		sqlmigration.NewAddAnonymousPublicDashboardTransactionFactory(sqlstore),
+		sqlmigration.NewMigrateRulesV4ToV5Factory(sqlstore, telemetryStore),
 	)
 }
 

pkg/sqlmigration/064_migrate_rules_v4_to_v5.go

@@ -0,0 +1,194 @@
+package sqlmigration
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"log/slog"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/telemetrystore"
+	"github.com/SigNoz/signoz/pkg/transition"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/migrate"
+)
+
+type migrateRulesV4ToV5 struct {
+	store          sqlstore.SQLStore
+	telemetryStore telemetrystore.TelemetryStore
+	logger         *slog.Logger
+}
+
+func NewMigrateRulesV4ToV5Factory(
+	store sqlstore.SQLStore,
+	telemetryStore telemetrystore.TelemetryStore,
+) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(
+		factory.MustNewName("migrate_rules_v4_to_v5"),
+		func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+			return &migrateRulesV4ToV5{
+				store:          store,
+				telemetryStore: telemetryStore,
+				logger:         ps.Logger,
+			}, nil
+		})
+}
+
+func (migration *migrateRulesV4ToV5) Register(migrations *migrate.Migrations) error {
+	if err := migrations.Register(migration.Up, migration.Down); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (migration *migrateRulesV4ToV5) getLogDuplicateKeys(ctx context.Context) ([]string, error) {
+	query := `
+		SELECT name
+		FROM (
+			SELECT DISTINCT name FROM signoz_logs.distributed_logs_attribute_keys
+			INTERSECT
+			SELECT DISTINCT name FROM signoz_logs.distributed_logs_resource_keys
+		)
+		ORDER BY name
+	`
+
+	rows, err := migration.telemetryStore.ClickhouseDB().Query(ctx, query)
+	if err != nil {
+		migration.logger.WarnContext(ctx, "failed to query log duplicate keys", "error", err)
+		return nil, nil
+	}
+	defer rows.Close()
+
+	var keys []string
+	for rows.Next() {
+		var key string
+		if err := rows.Scan(&key); err != nil {
+			migration.logger.WarnContext(ctx, "failed to scan log duplicate key", "error", err)
+			continue
+		}
+		keys = append(keys, key)
+	}
+
+	return keys, nil
+}
+
+func (migration *migrateRulesV4ToV5) getTraceDuplicateKeys(ctx context.Context) ([]string, error) {
+	query := `
+		SELECT tagKey
+		FROM signoz_traces.distributed_span_attributes_keys
+		WHERE tagType IN ('tag', 'resource')
+		GROUP BY tagKey
+		HAVING COUNT(DISTINCT tagType) > 1
+		ORDER BY tagKey
+	`
+
+	rows, err := migration.telemetryStore.ClickhouseDB().Query(ctx, query)
+	if err != nil {
+		migration.logger.WarnContext(ctx, "failed to query trace duplicate keys", "error", err)
+		return nil, nil
+	}
+	defer rows.Close()
+
+	var keys []string
+	for rows.Next() {
+		var key string
+		if err := rows.Scan(&key); err != nil {
+			migration.logger.WarnContext(ctx, "failed to scan trace duplicate key", "error", err)
+			continue
+		}
+		keys = append(keys, key)
+	}
+
+	return keys, nil
+}
+
+func (migration *migrateRulesV4ToV5) Up(ctx context.Context, db *bun.DB) error {
+	logsKeys, err := migration.getLogDuplicateKeys(ctx)
+	if err != nil {
+		return err
+	}
+
+	tracesKeys, err := migration.getTraceDuplicateKeys(ctx)
+	if err != nil {
+		return err
+	}
+
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+
+	defer func() {
+		_ = tx.Rollback()
+	}()
+
+	var rules []struct {
+		ID   string         `bun:"id"`
+		Data map[string]any `bun:"data"`
+	}
+
+	err = tx.NewSelect().
+		Table("rule").
+		Column("id", "data").
+		Scan(ctx, &rules)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil
+		}
+		return err
+	}
+
+	alertsMigrator := transition.NewAlertMigrateV5(migration.logger, logsKeys, tracesKeys)
+
+	for _, rule := range rules {
+		version, _ := rule.Data["version"].(string)
+		if version == "v5" {
+			continue
+		}
+
+		migration.logger.InfoContext(ctx, "migrating rule v4 to v5", "rule_id", rule.ID, "current_version", version)
+
+		// Check if the queries envelope already exists and is non-empty
+		hasQueriesEnvelope := false
+		if condition, ok := rule.Data["condition"].(map[string]any); ok {
+			if compositeQuery, ok := condition["compositeQuery"].(map[string]any); ok {
+				if queries, ok := compositeQuery["queries"].([]any); ok && len(queries) > 0 {
+					hasQueriesEnvelope = true
+				}
+			}
+		}
+
+		if hasQueriesEnvelope {
+			// Case 2: Already has queries envelope, just bump version
+			migration.logger.InfoContext(ctx, "rule already has queries envelope, bumping version", "rule_id", rule.ID)
+			rule.Data["version"] = "v5"
+		} else {
+			// Case 1: Old format, run full migration
+			migration.logger.InfoContext(ctx, "rule has old format, running full migration", "rule_id", rule.ID)
+			alertsMigrator.Migrate(ctx, rule.Data)
+			// Force version to v5 regardless of Migrate return value
+			rule.Data["version"] = "v5"
+		}
+
+		dataJSON, err := json.Marshal(rule.Data)
+		if err != nil {
+			return err
+		}
+
+		_, err = tx.NewUpdate().
+			Table("rule").
+			Set("data = ?", string(dataJSON)).
+			Where("id = ?", rule.ID).
+			Exec(ctx)
+		if err != nil {
+			return err
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *migrateRulesV4ToV5) Down(ctx context.Context, db *bun.DB) error {
+	return nil
+}

pkg/transition/v5_to_v4.go

@@ -1,102 +0,0 @@
-package transition
-
-import (
-	"fmt"
-
-	v3 "github.com/SigNoz/signoz/pkg/query-service/model/v3"
-	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
-)
-
-// ConvertV5TimeSeriesDataToV4Result converts v5 TimeSeriesData to v4 Result
-func ConvertV5TimeSeriesDataToV4Result(v5Data *qbtypes.TimeSeriesData) *v3.Result {
-	if v5Data == nil {
-		return nil
-	}
-
-	result := &v3.Result{
-		QueryName: v5Data.QueryName,
-		Series:    make([]*v3.Series, 0),
-	}
-
-	toV4Series := func(ts *qbtypes.TimeSeries) *v3.Series {
-		series := &v3.Series{
-			Labels:      make(map[string]string),
-			LabelsArray: make([]map[string]string, 0),
-			Points:      make([]v3.Point, 0, len(ts.Values)),
-		}
-
-		for _, label := range ts.Labels {
-			valueStr := fmt.Sprintf("%v", label.Value)
-			series.Labels[label.Key.Name] = valueStr
-		}
-
-		if len(series.Labels) > 0 {
-			series.LabelsArray = append(series.LabelsArray, series.Labels)
-		}
-
-		for _, tsValue := range ts.Values {
-			if tsValue.Partial {
-				continue
-			}
-
-			point := v3.Point{
-				Timestamp: tsValue.Timestamp,
-				Value:     tsValue.Value,
-			}
-			series.Points = append(series.Points, point)
-		}
-		return series
-	}
-
-	for _, aggBucket := range v5Data.Aggregations {
-		for _, ts := range aggBucket.Series {
-			result.Series = append(result.Series, toV4Series(ts))
-		}
-
-		if len(aggBucket.AnomalyScores) != 0 {
-			result.AnomalyScores = make([]*v3.Series, 0)
-			for _, ts := range aggBucket.AnomalyScores {
-				result.AnomalyScores = append(result.AnomalyScores, toV4Series(ts))
-			}
-		}
-
-		if len(aggBucket.PredictedSeries) != 0 {
-			result.PredictedSeries = make([]*v3.Series, 0)
-			for _, ts := range aggBucket.PredictedSeries {
-				result.PredictedSeries = append(result.PredictedSeries, toV4Series(ts))
-			}
-		}
-
-		if len(aggBucket.LowerBoundSeries) != 0 {
-			result.LowerBoundSeries = make([]*v3.Series, 0)
-			for _, ts := range aggBucket.LowerBoundSeries {
-				result.LowerBoundSeries = append(result.LowerBoundSeries, toV4Series(ts))
-			}
-		}
-
-		if len(aggBucket.UpperBoundSeries) != 0 {
-			result.UpperBoundSeries = make([]*v3.Series, 0)
-			for _, ts := range aggBucket.UpperBoundSeries {
-				result.UpperBoundSeries = append(result.UpperBoundSeries, toV4Series(ts))
-			}
-		}
-	}
-
-	return result
-}
-
-// ConvertV5TimeSeriesDataSliceToV4Results converts a slice of v5 TimeSeriesData to v4 QueryRangeResponse
-func ConvertV5TimeSeriesDataSliceToV4Results(v5DataSlice []*qbtypes.TimeSeriesData) *v3.QueryRangeResponse {
-	response := &v3.QueryRangeResponse{
-		ResultType: "matrix", // Time series data is typically "matrix" type
-		Result:     make([]*v3.Result, 0, len(v5DataSlice)),
-	}
-
-	for _, v5Data := range v5DataSlice {
-		if result := ConvertV5TimeSeriesDataToV4Result(v5Data); result != nil {
-			response.Result = append(response.Result, result)
-		}
-	}
-
-	return response
-}

pkg/types/querybuildertypes/querybuildertypesv5/resp.go

@@ -76,6 +76,33 @@ type TimeSeries struct {
 	Values []*TimeSeriesValue `json:"values"`
 }
 
+// LabelsMap converts the label slice to a map[string]string for use in
+// alert evaluation helpers that operate on flat label maps.
+func (ts *TimeSeries) LabelsMap() map[string]string {
+	if ts == nil {
+		return nil
+	}
+	m := make(map[string]string, len(ts.Labels))
+	for _, l := range ts.Labels {
+		m[l.Key.Name] = fmt.Sprintf("%v", l.Value)
+	}
+	return m
+}
+
+// NonPartialValues returns only the values where Partial is false.
+func (ts *TimeSeries) NonPartialValues() []*TimeSeriesValue {
+	if ts == nil {
+		return nil
+	}
+	result := make([]*TimeSeriesValue, 0, len(ts.Values))
+	for _, v := range ts.Values {
+		if !v.Partial {
+			result = append(result, v)
+		}
+	}
+	return result
+}
+
 type Label struct {
 	Key   telemetrytypes.TelemetryFieldKey `json:"key"`
 	Value any                              `json:"value"`

pkg/types/ruletypes/alerting.go

@@ -203,11 +203,11 @@ func (rc *RuleCondition) IsValid() bool {
 }
 
 // ShouldEval checks if the further series should be evaluated at all for alerts.
-func (rc *RuleCondition) ShouldEval(series *v3.Series) bool {
+func (rc *RuleCondition) ShouldEval(series *qbtypes.TimeSeries) bool {
 	if rc == nil {
 		return true
 	}
-	return !rc.RequireMinPoints || len(series.Points) >= rc.RequiredNumPoints
+	return !rc.RequireMinPoints || len(series.NonPartialValues()) >= rc.RequiredNumPoints
 }
 
 // QueryType is a shorthand method to get query type

pkg/types/ruletypes/api_params.go

@@ -355,6 +355,14 @@ func (r *PostableRule) validate() error {
 		errs = append(errs, signozError.NewInvalidInputf(signozError.CodeInvalidInput, "composite query is required"))
 	}
 
+	if r.Version != "" && r.Version != "v5" {
+		errs = append(errs, signozError.NewInvalidInputf(signozError.CodeInvalidInput, "only version v5 is supported, got %q", r.Version))
+	}
+
+	if r.Version == "v5" && r.RuleCondition.CompositeQuery != nil && len(r.RuleCondition.CompositeQuery.Queries) == 0 {
+		errs = append(errs, signozError.NewInvalidInputf(signozError.CodeInvalidInput, "queries envelope is required in compositeQuery"))
+	}
+
 	if isAllQueriesDisabled(r.RuleCondition.CompositeQuery) {
 		errs = append(errs, signozError.NewInvalidInputf(signozError.CodeInvalidInput, "all queries are disabled in rule condition"))
 	}

pkg/types/ruletypes/api_params_test.go

@@ -8,6 +8,8 @@ import (
 	"github.com/stretchr/testify/assert"
 
 	v3 "github.com/SigNoz/signoz/pkg/query-service/model/v3"
+	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 )
 
 func TestIsAllQueriesDisabled(t *testing.T) {
@@ -621,9 +623,9 @@ func TestParseIntoRuleThresholdGeneration(t *testing.T) {
 	}
 
 	// Test that threshold can evaluate properly
-	vector, err := threshold.Eval(v3.Series{
-		Points: []v3.Point{{Value: 0.15, Timestamp: 1000}}, // 150ms in seconds
-		Labels: map[string]string{"test": "label"},
+	vector, err := threshold.Eval(qbtypes.TimeSeries{
+		Values: []*qbtypes.TimeSeriesValue{{Value: 0.15, Timestamp: 1000}}, // 150ms in seconds
+		Labels: []*qbtypes.Label{{Key: telemetrytypes.TelemetryFieldKey{Name: "test"}, Value: "label"}},
 	}, "", EvalData{})
 	if err != nil {
 		t.Fatalf("Unexpected error in shouldAlert: %v", err)
@@ -698,9 +700,9 @@ func TestParseIntoRuleMultipleThresholds(t *testing.T) {
 	}
 
 	// Test with a value that should trigger both WARNING and CRITICAL thresholds
-	vector, err := threshold.Eval(v3.Series{
-		Points: []v3.Point{{Value: 95.0, Timestamp: 1000}}, // 95% CPU usage
-		Labels: map[string]string{"service": "test"},
+	vector, err := threshold.Eval(qbtypes.TimeSeries{
+		Values: []*qbtypes.TimeSeriesValue{{Value: 95.0, Timestamp: 1000}}, // 95% CPU usage
+		Labels: []*qbtypes.Label{{Key: telemetrytypes.TelemetryFieldKey{Name: "service"}, Value: "test"}},
 	}, "", EvalData{})
 	if err != nil {
 		t.Fatalf("Unexpected error in shouldAlert: %v", err)
@@ -708,9 +710,9 @@ func TestParseIntoRuleMultipleThresholds(t *testing.T) {
 
 	assert.Equal(t, 2, len(vector))
 
-	vector, err = threshold.Eval(v3.Series{
-		Points: []v3.Point{{Value: 75.0, Timestamp: 1000}}, // 75% CPU usage
-		Labels: map[string]string{"service": "test"},
+	vector, err = threshold.Eval(qbtypes.TimeSeries{
+		Values: []*qbtypes.TimeSeriesValue{{Value: 75.0, Timestamp: 1000}}, // 75% CPU usage
+		Labels: []*qbtypes.Label{{Key: telemetrytypes.TelemetryFieldKey{Name: "service"}, Value: "test"}},
 	}, "", EvalData{})
 	if err != nil {
 		t.Fatalf("Unexpected error in shouldAlert: %v", err)
@@ -723,7 +725,7 @@ func TestAnomalyNegationEval(t *testing.T) {
 	tests := []struct {
 		name          string
 		ruleJSON      []byte
-		series        v3.Series
+		series        qbtypes.TimeSeries
 		shouldAlert   bool
 		expectedValue float64
 	}{
@@ -751,9 +753,9 @@ func TestAnomalyNegationEval(t *testing.T) {
 					"selectedQuery": "A"
 				}
 			}`),
-			series: v3.Series{
-				Labels: map[string]string{"host": "server1"},
-				Points: []v3.Point{
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{{Key: telemetrytypes.TelemetryFieldKey{Name: "host"}, Value: "server1"}},
+				Values: []*qbtypes.TimeSeriesValue{
 					{Timestamp: 1000, Value: -2.1}, // below & at least once, should alert
 					{Timestamp: 2000, Value: -2.3},
 				},
@@ -785,9 +787,9 @@ func TestAnomalyNegationEval(t *testing.T) {
 					"selectedQuery": "A"
 				}
 			}`), // below & at least once, no value below -2.0
-			series: v3.Series{
-				Labels: map[string]string{"host": "server1"},
-				Points: []v3.Point{
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{{Key: telemetrytypes.TelemetryFieldKey{Name: "host"}, Value: "server1"}},
+				Values: []*qbtypes.TimeSeriesValue{
 					{Timestamp: 1000, Value: -1.9},
 					{Timestamp: 2000, Value: -1.8},
 				},
@@ -818,9 +820,9 @@ func TestAnomalyNegationEval(t *testing.T) {
 					"selectedQuery": "A"
 				}
 			}`), // above & at least once, should alert
-			series: v3.Series{
-				Labels: map[string]string{"host": "server1"},
-				Points: []v3.Point{
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{{Key: telemetrytypes.TelemetryFieldKey{Name: "host"}, Value: "server1"}},
+				Values: []*qbtypes.TimeSeriesValue{
 					{Timestamp: 1000, Value: 2.1}, // above 2.0, should alert
 					{Timestamp: 2000, Value: 2.2},
 				},
@@ -852,9 +854,9 @@ func TestAnomalyNegationEval(t *testing.T) {
 					"selectedQuery": "A"
 				}
 			}`),
-			series: v3.Series{
-				Labels: map[string]string{"host": "server1"},
-				Points: []v3.Point{
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{{Key: telemetrytypes.TelemetryFieldKey{Name: "host"}, Value: "server1"}},
+				Values: []*qbtypes.TimeSeriesValue{
 					{Timestamp: 1000, Value: 1.1},
 					{Timestamp: 2000, Value: 1.2},
 				},
@@ -885,9 +887,9 @@ func TestAnomalyNegationEval(t *testing.T) {
 					"selectedQuery": "A"
 				}
 			}`), // below and all the times
-			series: v3.Series{
-				Labels: map[string]string{"host": "server1"},
-				Points: []v3.Point{
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{{Key: telemetrytypes.TelemetryFieldKey{Name: "host"}, Value: "server1"}},
+				Values: []*qbtypes.TimeSeriesValue{
 					{Timestamp: 1000, Value: -2.1}, // all below -2
 					{Timestamp: 2000, Value: -2.2},
 					{Timestamp: 3000, Value: -2.5},
@@ -920,9 +922,9 @@ func TestAnomalyNegationEval(t *testing.T) {
 					"selectedQuery": "A"
 				}
 			}`),
-			series: v3.Series{
-				Labels: map[string]string{"host": "server1"},
-				Points: []v3.Point{
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{{Key: telemetrytypes.TelemetryFieldKey{Name: "host"}, Value: "server1"}},
+				Values: []*qbtypes.TimeSeriesValue{
 					{Timestamp: 1000, Value: -3.0},
 					{Timestamp: 2000, Value: -1.0}, // above -2, breaks condition
 					{Timestamp: 3000, Value: -2.5},
@@ -954,10 +956,10 @@ func TestAnomalyNegationEval(t *testing.T) {
 					"selectedQuery": "A"
 				}
 			}`),
-			series: v3.Series{
-				Labels: map[string]string{"host": "server1"},
-				Points: []v3.Point{
-					{Timestamp: 1000, Value: -8.0}, // abs(−8) >= 7, alert
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{{Key: telemetrytypes.TelemetryFieldKey{Name: "host"}, Value: "server1"}},
+				Values: []*qbtypes.TimeSeriesValue{
+					{Timestamp: 1000, Value: -8.0}, // abs(-8) >= 7, alert
 					{Timestamp: 2000, Value: 5.0},
 				},
 			},
@@ -988,9 +990,9 @@ func TestAnomalyNegationEval(t *testing.T) {
 					"selectedQuery": "A"
 				}
 			}`),
-			series: v3.Series{
-				Labels: map[string]string{"host": "server1"},
-				Points: []v3.Point{
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{{Key: telemetrytypes.TelemetryFieldKey{Name: "host"}, Value: "server1"}},
+				Values: []*qbtypes.TimeSeriesValue{
 					{Timestamp: 1000, Value: 80.0}, // below 90, should alert
 					{Timestamp: 2000, Value: 85.0},
 				},
@@ -1022,9 +1024,9 @@ func TestAnomalyNegationEval(t *testing.T) {
 					"selectedQuery": "A"
 				}
 			}`),
-			series: v3.Series{
-				Labels: map[string]string{"host": "server1"},
-				Points: []v3.Point{
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{{Key: telemetrytypes.TelemetryFieldKey{Name: "host"}, Value: "server1"}},
+				Values: []*qbtypes.TimeSeriesValue{
 					{Timestamp: 1000, Value: 60.0}, // below, should alert
 					{Timestamp: 2000, Value: 90.0},
 				},

pkg/types/ruletypes/threshold.go

@@ -8,8 +8,8 @@ import (
 
 	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/query-service/converter"
-	v3 "github.com/SigNoz/signoz/pkg/query-service/model/v3"
 	"github.com/SigNoz/signoz/pkg/query-service/utils/labels"
+	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/valuer"
 )
 
@@ -83,7 +83,7 @@ func (eval EvalData) HasActiveAlert(sampleLabelFp uint64) bool {
 type RuleThreshold interface {
 	// Eval runs the given series through the threshold rules
 	// using the given EvalData and returns the matching series
-	Eval(series v3.Series, unit string, evalData EvalData) (Vector, error)
+	Eval(series qbtypes.TimeSeries, unit string, evalData EvalData) (Vector, error)
 	GetRuleReceivers() []RuleReceivers
 }
 
@@ -122,10 +122,11 @@ func (r BasicRuleThresholds) Validate() error {
 	return errors.Join(errs...)
 }
 
-func (r BasicRuleThresholds) Eval(series v3.Series, unit string, evalData EvalData) (Vector, error) {
+func (r BasicRuleThresholds) Eval(series qbtypes.TimeSeries, unit string, evalData EvalData) (Vector, error) {
 	var resultVector Vector
 	thresholds := []BasicRuleThreshold(r)
 	sortThresholds(thresholds)
+	seriesLabels := series.LabelsMap()
 	for _, threshold := range thresholds {
 		smpl, shouldAlert := threshold.shouldAlert(series, unit)
 		if shouldAlert {
@@ -137,15 +138,15 @@ func (r BasicRuleThresholds) Eval(series v3.Series, unit string, evalData EvalDa
 			resultVector = append(resultVector, smpl)
 			continue
 		} else if evalData.SendUnmatched {
-			// Sanitise the series points to remove any NaN or Inf values
-			series.Points = removeGroupinSetPoints(series)
-			if len(series.Points) == 0 {
+			// Sanitise the series values to remove any NaN, Inf, or partial values
+			values := filterValidValues(series.Values)
+			if len(values) == 0 {
 				continue
 			}
-			// prepare the sample with the first point of the series
+			// prepare the sample with the first value of the series
 			smpl := Sample{
-				Point:      Point{T: series.Points[0].Timestamp, V: series.Points[0].Value},
-				Metric:     PrepareSampleLabelsForRule(series.Labels, threshold.Name),
+				Point:      Point{T: values[0].Timestamp, V: values[0].Value},
+				Metric:     PrepareSampleLabelsForRule(seriesLabels, threshold.Name),
 				Target:     *threshold.TargetValue,
 				TargetUnit: threshold.TargetUnit,
 			}
@@ -160,7 +161,7 @@ func (r BasicRuleThresholds) Eval(series v3.Series, unit string, evalData EvalDa
 		if threshold.RecoveryTarget == nil {
 			continue
 		}
-		sampleLabels := PrepareSampleLabelsForRule(series.Labels, threshold.Name)
+		sampleLabels := PrepareSampleLabelsForRule(seriesLabels, threshold.Name)
 		alertHash := sampleLabels.Hash()
 		// check if alert is active and then check if recovery threshold matches
 		if evalData.HasActiveAlert(alertHash) {
@@ -255,18 +256,23 @@ func (b BasicRuleThreshold) Validate() error {
 	return errors.Join(errs...)
 }
 
-func (b BasicRuleThreshold) matchesRecoveryThreshold(series v3.Series, ruleUnit string) (Sample, bool) {
+func (b BasicRuleThreshold) matchesRecoveryThreshold(series qbtypes.TimeSeries, ruleUnit string) (Sample, bool) {
 	return b.shouldAlertWithTarget(series, b.recoveryTarget(ruleUnit))
 }
-func (b BasicRuleThreshold) shouldAlert(series v3.Series, ruleUnit string) (Sample, bool) {
+func (b BasicRuleThreshold) shouldAlert(series qbtypes.TimeSeries, ruleUnit string) (Sample, bool) {
 	return b.shouldAlertWithTarget(series, b.target(ruleUnit))
 }
 
-func removeGroupinSetPoints(series v3.Series) []v3.Point {
-	var result []v3.Point
-	for _, s := range series.Points {
-		if s.Timestamp >= 0 && !math.IsNaN(s.Value) && !math.IsInf(s.Value, 0) {
-			result = append(result, s)
+// filterValidValues returns only the values that are valid for alert evaluation:
+// non-partial, non-NaN, non-Inf, and with non-negative timestamps.
+func filterValidValues(values []*qbtypes.TimeSeriesValue) []*qbtypes.TimeSeriesValue {
+	var result []*qbtypes.TimeSeriesValue
+	for _, v := range values {
+		if v.Partial {
+			continue
+		}
+		if v.Timestamp >= 0 && !math.IsNaN(v.Value) && !math.IsInf(v.Value, 0) {
+			result = append(result, v)
 		}
 	}
 	return result
@@ -284,15 +290,15 @@ func PrepareSampleLabelsForRule(seriesLabels map[string]string, thresholdName st
 	return lb.Labels()
 }
 
-func (b BasicRuleThreshold) shouldAlertWithTarget(series v3.Series, target float64) (Sample, bool) {
+func (b BasicRuleThreshold) shouldAlertWithTarget(series qbtypes.TimeSeries, target float64) (Sample, bool) {
 	var shouldAlert bool
 	var alertSmpl Sample
-	lbls := PrepareSampleLabelsForRule(series.Labels, b.Name)
+	lbls := PrepareSampleLabelsForRule(series.LabelsMap(), b.Name)
 
-	series.Points = removeGroupinSetPoints(series)
+	values := filterValidValues(series.Values)
 
 	// nothing to evaluate
-	if len(series.Points) == 0 {
+	if len(values) == 0 {
 		return alertSmpl, false
 	}
 
@@ -300,7 +306,7 @@ func (b BasicRuleThreshold) shouldAlertWithTarget(series v3.Series, target float
 	case AtleastOnce:
 		// If any sample matches the condition, the rule is firing.
 		if b.CompareOp == ValueIsAbove {
-			for _, smpl := range series.Points {
+			for _, smpl := range values {
 				if smpl.Value > target {
 					alertSmpl = Sample{Point: Point{V: smpl.Value}, Metric: lbls}
 					shouldAlert = true
@@ -308,7 +314,7 @@ func (b BasicRuleThreshold) shouldAlertWithTarget(series v3.Series, target float
 				}
 			}
 		} else if b.CompareOp == ValueIsBelow {
-			for _, smpl := range series.Points {
+			for _, smpl := range values {
 				if smpl.Value < target {
 					alertSmpl = Sample{Point: Point{V: smpl.Value}, Metric: lbls}
 					shouldAlert = true
@@ -316,7 +322,7 @@ func (b BasicRuleThreshold) shouldAlertWithTarget(series v3.Series, target float
 				}
 			}
 		} else if b.CompareOp == ValueIsEq {
-			for _, smpl := range series.Points {
+			for _, smpl := range values {
 				if smpl.Value == target {
 					alertSmpl = Sample{Point: Point{V: smpl.Value}, Metric: lbls}
 					shouldAlert = true
@@ -324,7 +330,7 @@ func (b BasicRuleThreshold) shouldAlertWithTarget(series v3.Series, target float
 				}
 			}
 		} else if b.CompareOp == ValueIsNotEq {
-			for _, smpl := range series.Points {
+			for _, smpl := range values {
 				if smpl.Value != target {
 					alertSmpl = Sample{Point: Point{V: smpl.Value}, Metric: lbls}
 					shouldAlert = true
@@ -332,7 +338,7 @@ func (b BasicRuleThreshold) shouldAlertWithTarget(series v3.Series, target float
 				}
 			}
 		} else if b.CompareOp == ValueOutsideBounds {
-			for _, smpl := range series.Points {
+			for _, smpl := range values {
 				if math.Abs(smpl.Value) >= target {
 					alertSmpl = Sample{Point: Point{V: smpl.Value}, Metric: lbls}
 					shouldAlert = true
@@ -345,7 +351,7 @@ func (b BasicRuleThreshold) shouldAlertWithTarget(series v3.Series, target float
 		shouldAlert = true
 		alertSmpl = Sample{Point: Point{V: target}, Metric: lbls}
 		if b.CompareOp == ValueIsAbove {
-			for _, smpl := range series.Points {
+			for _, smpl := range values {
 				if smpl.Value <= target {
 					shouldAlert = false
 					break
@@ -354,7 +360,7 @@ func (b BasicRuleThreshold) shouldAlertWithTarget(series v3.Series, target float
 			// use min value from the series
 			if shouldAlert {
 				var minValue float64 = math.Inf(1)
-				for _, smpl := range series.Points {
+				for _, smpl := range values {
 					if smpl.Value < minValue {
 						minValue = smpl.Value
 					}
@@ -362,7 +368,7 @@ func (b BasicRuleThreshold) shouldAlertWithTarget(series v3.Series, target float
 				alertSmpl = Sample{Point: Point{V: minValue}, Metric: lbls}
 			}
 		} else if b.CompareOp == ValueIsBelow {
-			for _, smpl := range series.Points {
+			for _, smpl := range values {
 				if smpl.Value >= target {
 					shouldAlert = false
 					break
@@ -370,7 +376,7 @@ func (b BasicRuleThreshold) shouldAlertWithTarget(series v3.Series, target float
 			}
 			if shouldAlert {
 				var maxValue float64 = math.Inf(-1)
-				for _, smpl := range series.Points {
+				for _, smpl := range values {
 					if smpl.Value > maxValue {
 						maxValue = smpl.Value
 					}
@@ -378,14 +384,14 @@ func (b BasicRuleThreshold) shouldAlertWithTarget(series v3.Series, target float
 				alertSmpl = Sample{Point: Point{V: maxValue}, Metric: lbls}
 			}
 		} else if b.CompareOp == ValueIsEq {
-			for _, smpl := range series.Points {
+			for _, smpl := range values {
 				if smpl.Value != target {
 					shouldAlert = false
 					break
 				}
 			}
 		} else if b.CompareOp == ValueIsNotEq {
-			for _, smpl := range series.Points {
+			for _, smpl := range values {
 				if smpl.Value == target {
 					shouldAlert = false
 					break
@@ -393,7 +399,7 @@ func (b BasicRuleThreshold) shouldAlertWithTarget(series v3.Series, target float
 			}
 			// use any non-inf or nan value from the series
 			if shouldAlert {
-				for _, smpl := range series.Points {
+				for _, smpl := range values {
 					if !math.IsInf(smpl.Value, 0) && !math.IsNaN(smpl.Value) {
 						alertSmpl = Sample{Point: Point{V: smpl.Value}, Metric: lbls}
 						break
@@ -401,7 +407,7 @@ func (b BasicRuleThreshold) shouldAlertWithTarget(series v3.Series, target float
 				}
 			}
 		} else if b.CompareOp == ValueOutsideBounds {
-			for _, smpl := range series.Points {
+			for _, smpl := range values {
 				if math.Abs(smpl.Value) < target {
 					alertSmpl = Sample{Point: Point{V: smpl.Value}, Metric: lbls}
 					shouldAlert = false
@@ -412,7 +418,7 @@ func (b BasicRuleThreshold) shouldAlertWithTarget(series v3.Series, target float
 	case OnAverage:
 		// If the average of all samples matches the condition, the rule is firing.
 		var sum, count float64
-		for _, smpl := range series.Points {
+		for _, smpl := range values {
 			if math.IsNaN(smpl.Value) || math.IsInf(smpl.Value, 0) {
 				continue
 			}
@@ -446,7 +452,7 @@ func (b BasicRuleThreshold) shouldAlertWithTarget(series v3.Series, target float
 		// If the sum of all samples matches the condition, the rule is firing.
 		var sum float64
 
-		for _, smpl := range series.Points {
+		for _, smpl := range values {
 			if math.IsNaN(smpl.Value) || math.IsInf(smpl.Value, 0) {
 				continue
 			}
@@ -477,21 +483,22 @@ func (b BasicRuleThreshold) shouldAlertWithTarget(series v3.Series, target float
 	case Last:
 		// If the last sample matches the condition, the rule is firing.
 		shouldAlert = false
-		alertSmpl = Sample{Point: Point{V: series.Points[len(series.Points)-1].Value}, Metric: lbls}
+		lastValue := values[len(values)-1].Value
+		alertSmpl = Sample{Point: Point{V: lastValue}, Metric: lbls}
 		if b.CompareOp == ValueIsAbove {
-			if series.Points[len(series.Points)-1].Value > target {
+			if lastValue > target {
 				shouldAlert = true
 			}
 		} else if b.CompareOp == ValueIsBelow {
-			if series.Points[len(series.Points)-1].Value < target {
+			if lastValue < target {
 				shouldAlert = true
 			}
 		} else if b.CompareOp == ValueIsEq {
-			if series.Points[len(series.Points)-1].Value == target {
+			if lastValue == target {
 				shouldAlert = true
 			}
 		} else if b.CompareOp == ValueIsNotEq {
-			if series.Points[len(series.Points)-1].Value != target {
+			if lastValue != target {
 				shouldAlert = true
 			}
 		}

pkg/types/ruletypes/threshold_test.go

@@ -6,16 +6,24 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	v3 "github.com/SigNoz/signoz/pkg/query-service/model/v3"
+	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 )
 
 func TestBasicRuleThresholdEval_UnitConversion(t *testing.T) {
 	target := 100.0
 
+	makeLabel := func(name, value string) *qbtypes.Label {
+		return &qbtypes.Label{Key: telemetrytypes.TelemetryFieldKey{Name: name}, Value: value}
+	}
+	makeValue := func(value float64, ts int64) *qbtypes.TimeSeriesValue {
+		return &qbtypes.TimeSeriesValue{Value: value, Timestamp: ts}
+	}
+
 	tests := []struct {
 		name        string
 		threshold   BasicRuleThreshold
-		series      v3.Series
+		series      qbtypes.TimeSeries
 		ruleUnit    string
 		shouldAlert bool
 	}{
@@ -28,11 +36,9 @@ func TestBasicRuleThresholdEval_UnitConversion(t *testing.T) {
 				MatchType:   AtleastOnce,
 				CompareOp:   ValueIsAbove,
 			},
-			series: v3.Series{
-				Labels: map[string]string{"service": "test"},
-				Points: []v3.Point{
-					{Value: 0.15, Timestamp: 1000}, // 150ms in seconds
-				},
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{makeLabel("service", "test")},
+				Values: []*qbtypes.TimeSeriesValue{makeValue(0.15, 1000)}, // 150ms in seconds
 			},
 			ruleUnit:    "s",
 			shouldAlert: true,
@@ -46,11 +52,9 @@ func TestBasicRuleThresholdEval_UnitConversion(t *testing.T) {
 				MatchType:   AtleastOnce,
 				CompareOp:   ValueIsAbove,
 			},
-			series: v3.Series{
-				Labels: map[string]string{"service": "test"},
-				Points: []v3.Point{
-					{Value: 0.05, Timestamp: 1000}, // 50ms in seconds
-				},
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{makeLabel("service", "test")},
+				Values: []*qbtypes.TimeSeriesValue{makeValue(0.05, 1000)}, // 50ms in seconds
 			},
 			ruleUnit:    "s",
 			shouldAlert: false,
@@ -64,11 +68,9 @@ func TestBasicRuleThresholdEval_UnitConversion(t *testing.T) {
 				MatchType:   AtleastOnce,
 				CompareOp:   ValueIsAbove,
 			},
-			series: v3.Series{
-				Labels: map[string]string{"service": "test"},
-				Points: []v3.Point{
-					{Value: 150000, Timestamp: 1000}, // 150000ms = 150s
-				},
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{makeLabel("service", "test")},
+				Values: []*qbtypes.TimeSeriesValue{makeValue(150000, 1000)}, // 150000ms = 150s
 			},
 			ruleUnit:    "ms",
 			shouldAlert: true,
@@ -83,11 +85,9 @@ func TestBasicRuleThresholdEval_UnitConversion(t *testing.T) {
 				MatchType:   AtleastOnce,
 				CompareOp:   ValueIsAbove,
 			},
-			series: v3.Series{
-				Labels: map[string]string{"service": "test"},
-				Points: []v3.Point{
-					{Value: 0.15, Timestamp: 1000}, // 0.15KiB ≈ 153.6 bytes
-				},
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{makeLabel("service", "test")},
+				Values: []*qbtypes.TimeSeriesValue{makeValue(0.15, 1000)}, // 0.15KiB ≈ 153.6 bytes
 			},
 			ruleUnit:    "kbytes",
 			shouldAlert: true,
@@ -101,11 +101,9 @@ func TestBasicRuleThresholdEval_UnitConversion(t *testing.T) {
 				MatchType:   AtleastOnce,
 				CompareOp:   ValueIsAbove,
 			},
-			series: v3.Series{
-				Labels: map[string]string{"service": "test"},
-				Points: []v3.Point{
-					{Value: 0.15, Timestamp: 1000},
-				},
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{makeLabel("service", "test")},
+				Values: []*qbtypes.TimeSeriesValue{makeValue(0.15, 1000)},
 			},
 			ruleUnit:    "mbytes",
 			shouldAlert: true,
@@ -120,11 +118,9 @@ func TestBasicRuleThresholdEval_UnitConversion(t *testing.T) {
 				MatchType:   AtleastOnce,
 				CompareOp:   ValueIsBelow,
 			},
-			series: v3.Series{
-				Labels: map[string]string{"service": "test"},
-				Points: []v3.Point{
-					{Value: 0.05, Timestamp: 1000}, // 50ms in seconds
-				},
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{makeLabel("service", "test")},
+				Values: []*qbtypes.TimeSeriesValue{makeValue(0.05, 1000)}, // 50ms in seconds
 			},
 			ruleUnit:    "s",
 			shouldAlert: true,
@@ -138,12 +134,12 @@ func TestBasicRuleThresholdEval_UnitConversion(t *testing.T) {
 				MatchType:   OnAverage,
 				CompareOp:   ValueIsAbove,
 			},
-			series: v3.Series{
-				Labels: map[string]string{"service": "test"},
-				Points: []v3.Point{
-					{Value: 0.08, Timestamp: 1000}, // 80ms
-					{Value: 0.12, Timestamp: 2000}, // 120ms
-					{Value: 0.15, Timestamp: 3000}, // 150ms
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{makeLabel("service", "test")},
+				Values: []*qbtypes.TimeSeriesValue{
+					makeValue(0.08, 1000), // 80ms
+					makeValue(0.12, 2000), // 120ms
+					makeValue(0.15, 3000), // 150ms
 				},
 			},
 			ruleUnit:    "s",
@@ -158,12 +154,12 @@ func TestBasicRuleThresholdEval_UnitConversion(t *testing.T) {
 				MatchType:   InTotal,
 				CompareOp:   ValueIsAbove,
 			},
-			series: v3.Series{
-				Labels: map[string]string{"service": "test"},
-				Points: []v3.Point{
-					{Value: 0.04, Timestamp: 1000}, // 40MB
-					{Value: 0.05, Timestamp: 2000}, // 50MB
-					{Value: 0.03, Timestamp: 3000}, // 30MB
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{makeLabel("service", "test")},
+				Values: []*qbtypes.TimeSeriesValue{
+					makeValue(0.04, 1000), // 40MB
+					makeValue(0.05, 2000), // 50MB
+					makeValue(0.03, 3000), // 30MB
 				},
 			},
 			ruleUnit:    "decgbytes",
@@ -178,12 +174,12 @@ func TestBasicRuleThresholdEval_UnitConversion(t *testing.T) {
 				MatchType:   AllTheTimes,
 				CompareOp:   ValueIsAbove,
 			},
-			series: v3.Series{
-				Labels: map[string]string{"service": "test"},
-				Points: []v3.Point{
-					{Value: 0.11, Timestamp: 1000}, // 110ms
-					{Value: 0.12, Timestamp: 2000}, // 120ms
-					{Value: 0.15, Timestamp: 3000}, // 150ms
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{makeLabel("service", "test")},
+				Values: []*qbtypes.TimeSeriesValue{
+					makeValue(0.11, 1000), // 110ms
+					makeValue(0.12, 2000), // 120ms
+					makeValue(0.15, 3000), // 150ms
 				},
 			},
 			ruleUnit:    "s",
@@ -198,11 +194,11 @@ func TestBasicRuleThresholdEval_UnitConversion(t *testing.T) {
 				MatchType:   Last,
 				CompareOp:   ValueIsAbove,
 			},
-			series: v3.Series{
-				Labels: map[string]string{"service": "test"},
-				Points: []v3.Point{
-					{Value: 0.15, Timestamp: 1000}, // 150kB
-					{Value: 0.05, Timestamp: 2000}, // 50kB (last value)
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{makeLabel("service", "test")},
+				Values: []*qbtypes.TimeSeriesValue{
+					makeValue(0.15, 1000), // 150kB
+					makeValue(0.05, 2000), // 50kB (last value)
 				},
 			},
 			ruleUnit:    "decmbytes",
@@ -218,11 +214,9 @@ func TestBasicRuleThresholdEval_UnitConversion(t *testing.T) {
 				MatchType:   AtleastOnce,
 				CompareOp:   ValueIsAbove,
 			},
-			series: v3.Series{
-				Labels: map[string]string{"service": "test"},
-				Points: []v3.Point{
-					{Value: 0.15, Timestamp: 1000},
-				},
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{makeLabel("service", "test")},
+				Values: []*qbtypes.TimeSeriesValue{makeValue(0.15, 1000)},
 			},
 			ruleUnit:    "KBs",
 			shouldAlert: true,
@@ -237,11 +231,9 @@ func TestBasicRuleThresholdEval_UnitConversion(t *testing.T) {
 				MatchType:   AtleastOnce,
 				CompareOp:   ValueIsAbove,
 			},
-			series: v3.Series{
-				Labels: map[string]string{"service": "test"},
-				Points: []v3.Point{
-					{Value: 150, Timestamp: 1000}, // 150ms
-				},
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{makeLabel("service", "test")},
+				Values: []*qbtypes.TimeSeriesValue{makeValue(150, 1000)}, // 150ms
 			},
 			ruleUnit:    "ms",
 			shouldAlert: true,
@@ -256,11 +248,9 @@ func TestBasicRuleThresholdEval_UnitConversion(t *testing.T) {
 				MatchType:   AtleastOnce,
 				CompareOp:   ValueIsAbove,
 			},
-			series: v3.Series{
-				Labels: map[string]string{"service": "test"},
-				Points: []v3.Point{
-					{Value: 150, Timestamp: 1000}, // 150 (unitless)
-				},
+			series: qbtypes.TimeSeries{
+				Labels: []*qbtypes.Label{makeLabel("service", "test")},
+				Values: []*qbtypes.TimeSeriesValue{makeValue(150, 1000)}, // 150 (unitless)
 			},
 			ruleUnit:    "",
 			shouldAlert: true,

tests/integration/fixtures/alertutils.py

@@ -112,7 +112,7 @@ def verify_webhook_alert_expectation(
                 break
 
         # wait for some time before checking again
-        time.sleep(10)
+        time.sleep(1)
 
     # We've waited but we didn't get the expected number of alerts
 
@@ -133,3 +133,15 @@ def verify_webhook_alert_expectation(
     )
 
     return True  # should not reach here
+
+
+def update_rule_channel_name(rule_data: dict, channel_name: str):
+    """
+    updates the channel name in the thresholds
+    so alert notification are sent to the given channel
+    """
+    thresholds = rule_data["condition"]["thresholds"]
+    if "kind" in thresholds and thresholds["kind"] == "basic":
+        # loop over all the sepcs and update the channels
+        for spec in thresholds["spec"]:
+            spec["channels"] = [channel_name]

tests/integration/fixtures/cloudintegrations.py

@@ -1,16 +1,18 @@
 """Fixtures for cloud integration tests."""
-from typing import Callable, Optional
+
 from http import HTTPStatus
+from typing import Callable, Optional
 
 import pytest
 import requests
 
 from fixtures import types
-from fixtures.logger import setup_logger
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.logger import setup_logger
 
 logger = setup_logger(__name__)
 
+
 @pytest.fixture(scope="function")
 def create_cloud_integration_account(
     request: pytest.FixtureRequest,
@@ -24,9 +26,7 @@ def create_cloud_integration_account(
         cloud_provider: str = "aws",
     ) -> dict:
         nonlocal created_account_id, cloud_provider_used
-        endpoint = (
-            f"/api/v1/cloud-integrations/{cloud_provider}/accounts/generate-connection-url"
-        )
+        endpoint = f"/api/v1/cloud-integrations/{cloud_provider}/accounts/generate-connection-url"
 
         request_payload = {
             "account_config": {"regions": ["us-east-1"]},
@@ -59,9 +59,7 @@ def create_cloud_integration_account(
 
     def _disconnect(admin_token: str, cloud_provider: str) -> requests.Response:
         assert created_account_id
-        disconnect_endpoint = (
-            f"/api/v1/cloud-integrations/{cloud_provider}/accounts/{created_account_id}/disconnect"
-        )
+        disconnect_endpoint = f"/api/v1/cloud-integrations/{cloud_provider}/accounts/{created_account_id}/disconnect"
         return requests.post(
             signoz.self.host_configs["8080"].get(disconnect_endpoint),
             headers={"Authorization": f"Bearer {admin_token}"},

tests/integration/fixtures/cloudintegrationsutils.py

@@ -1,4 +1,5 @@
 """Fixtures for cloud integration tests."""
+
 from http import HTTPStatus
 
 import requests

tests/integration/fixtures/metrics.py

@@ -43,6 +43,10 @@ class MetricsTimeSeries(ABC):
         resource_attrs: dict[str, str] = {},
         scope_attrs: dict[str, str] = {},
     ) -> None:
+        # Create a copy of labels to avoid mutating the caller's dictionary
+        labels = dict(labels)
+        # Add metric_name to the labels to support promql queries
+        labels["__name__"] = metric_name
         self.env = env
         self.metric_name = metric_name
         self.temporality = temporality

tests/integration/fixtures/signoz.py

@@ -69,6 +69,10 @@ def signoz(  # pylint: disable=too-many-arguments,too-many-positional-arguments
                 "SIGNOZ_GLOBAL_INGESTION__URL": "https://ingest.test.signoz.cloud",
                 "SIGNOZ_USER_PASSWORD_RESET_ALLOW__SELF": True,
                 "SIGNOZ_USER_PASSWORD_RESET_MAX__TOKEN__LIFETIME": "6h",
+                "RULES_EVAL_DELAY": "0s",
+                "SIGNOZ_ALERTMANAGER_SIGNOZ_POLL__INTERVAL": "5s",
+                "SIGNOZ_ALERTMANAGER_SIGNOZ_ROUTE_GROUP__WAIT": "1s",
+                "SIGNOZ_ALERTMANAGER_SIGNOZ_ROUTE_GROUP__INTERVAL": "5s",
             }
             | sqlstore.env
             | clickhouse.env

tests/integration/fixtures/types.py

@@ -191,3 +191,15 @@ class AlertExpectation:
     # seconds to wait for the alerts to be fired, if no
     # alerts are fired in the expected time, the test will fail
     wait_time_seconds: int
+
+
+@dataclass(frozen=True)
+class AlertTestCase:
+    # name of the test case
+    name: str
+    # path to the rule file in testdata directory
+    rule_path: str
+    # list of alert data that will be inserted into the database
+    alert_data: List[AlertData]
+    # list of alert expectations for the test case
+    alert_expectation: AlertExpectation

tests/integration/src/alerts/01_notification_channel.py

@@ -8,6 +8,9 @@ from wiremock.client import HttpMethods, Mapping, MappingRequest, MappingRespons
 
 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.logger import setup_logger
+
+logger = setup_logger(__name__)
 
 
 def test_webhook_notification_channel(
@@ -20,6 +23,7 @@ def test_webhook_notification_channel(
     """
     Tests the creation and delivery of test alerts on the created notification channel
     """
+    logger.info("Setting up notification channel")
 
     # Prepare notification channel name and webhook endpoint
     notification_channel_name = f"notification-channel-{uuid.uuid4()}"
@@ -55,10 +59,10 @@ def test_webhook_notification_channel(
     )
 
     # TODO: @abhishekhugetech # pylint: disable=W0511
-    # Time required for Org to be registered
-    # in the alertmanager, default 1m.
+    # Time required for newly created Org to be registered in the alertmanager is 5 seconds in signoz.py
     # this will be fixed after [https://github.com/SigNoz/engineering-pod/issues/3800]
-    time.sleep(65)
+    # 10 seconds safe time for org to be registered in the alertmanager
+    time.sleep(10)
 
     # Call test API for the notification channel
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)

tests/integration/src/alerts/02_basic_alert_conditions.py

@@ -0,0 +1,671 @@
+import json
+import uuid
+from datetime import datetime, timedelta, timezone
+from typing import Callable, List
+
+import pytest
+from wiremock.client import HttpMethods, Mapping, MappingRequest, MappingResponse
+
+from fixtures import types
+from fixtures.alertutils import (
+    update_rule_channel_name,
+    verify_webhook_alert_expectation,
+)
+from fixtures.logger import setup_logger
+from fixtures.utils import get_testdata_file_path
+
+# test cases for match type and compare operators have wait time of 30 seconds to verify the alert expectation.
+# we've poistioned the alert data to fire the alert on first eval of rule manager, the eval frequency
+# for most alert rules are set of 15s so considering this delay plus some delay from alert manager's
+# group_wait and group_interval, even in worst case most alerts should be triggered in about 30 seconds
+TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
+    types.AlertTestCase(
+        name="test_threshold_above_at_least_once",
+        rule_path="alerts/test_scenarios/threshold_above_at_least_once/rule.json",
+        alert_data=[
+            types.AlertData(
+                type="metrics",
+                data_path="alerts/test_scenarios/threshold_above_at_least_once/alert_data.jsonl",
+            ),
+        ],
+        alert_expectation=types.AlertExpectation(
+            should_alert=True,
+            wait_time_seconds=30,
+            expected_alerts=[
+                types.FiringAlert(
+                    labels={
+                        "alertname": "threshold_above_at_least_once",
+                        "threshold.name": "critical",
+                    }
+                ),
+            ],
+        ),
+    ),
+    types.AlertTestCase(
+        name="test_threshold_above_all_the_time",
+        rule_path="alerts/test_scenarios/threshold_above_all_the_time/rule.json",
+        alert_data=[
+            types.AlertData(
+                type="metrics",
+                data_path="alerts/test_scenarios/threshold_above_all_the_time/alert_data.jsonl",
+            ),
+        ],
+        alert_expectation=types.AlertExpectation(
+            should_alert=True,
+            wait_time_seconds=30,
+            expected_alerts=[
+                types.FiringAlert(
+                    labels={
+                        "alertname": "threshold_above_all_the_time",
+                        "threshold.name": "critical",
+                    }
+                ),
+            ],
+        ),
+    ),
+    types.AlertTestCase(
+        name="test_threshold_above_in_total",
+        rule_path="alerts/test_scenarios/threshold_above_in_total/rule.json",
+        alert_data=[
+            types.AlertData(
+                type="metrics",
+                data_path="alerts/test_scenarios/threshold_above_in_total/alert_data.jsonl",
+            ),
+        ],
+        alert_expectation=types.AlertExpectation(
+            should_alert=True,
+            wait_time_seconds=30,
+            expected_alerts=[
+                types.FiringAlert(
+                    labels={
+                        "alertname": "threshold_above_in_total",
+                        "threshold.name": "critical",
+                        "service": "server",
+                    },
+                ),
+                types.FiringAlert(
+                    labels={
+                        "alertname": "threshold_above_in_total",
+                        "threshold.name": "critical",
+                        "service": "api",
+                    }
+                ),
+            ],
+        ),
+    ),
+    types.AlertTestCase(
+        name="test_threshold_above_average",
+        rule_path="alerts/test_scenarios/threshold_above_average/rule.json",
+        alert_data=[
+            types.AlertData(
+                type="traces",
+                data_path="alerts/test_scenarios/threshold_above_average/alert_data.jsonl",
+            ),
+        ],
+        alert_expectation=types.AlertExpectation(
+            should_alert=True,
+            wait_time_seconds=30,
+            expected_alerts=[
+                types.FiringAlert(
+                    labels={
+                        "alertname": "threshold_above_average",
+                        "threshold.name": "critical",
+                    }
+                ),
+            ],
+        ),
+    ),
+    # TODO: @abhishekhugetech enable the test for matchType last, pylint: disable=W0511
+    # after the [issue](https://github.com/SigNoz/engineering-pod/issues/3801) with matchType last is fixed
+    # types.AlertTestCase(
+    #     name="test_threshold_above_last",
+    #     rule_path="alerts/test_scenarios/threshold_above_last/rule.json",
+    #     alert_data=[
+    #         types.AlertData(
+    #             type="metrics",
+    #             data_path="alerts/test_scenarios/threshold_above_last/alert_data.jsonl",
+    #         ),
+    #     ],
+    #     alert_expectation=types.AlertExpectation(
+    #         should_alert=True,
+    #         wait_time_seconds=30,
+    #         expected_alerts=[
+    #             types.FiringAlert(
+    #                 labels={
+    #                     "alertname": "threshold_above_last",
+    #                     "threshold.name": "critical",
+    #                 }
+    #             ),
+    #         ],
+    #     ),
+    # ),
+    types.AlertTestCase(
+        name="test_threshold_below_at_least_once",
+        rule_path="alerts/test_scenarios/threshold_below_at_least_once/rule.json",
+        alert_data=[
+            types.AlertData(
+                type="logs",
+                data_path="alerts/test_scenarios/threshold_below_at_least_once/alert_data.jsonl",
+            ),
+        ],
+        alert_expectation=types.AlertExpectation(
+            should_alert=True,
+            wait_time_seconds=30,
+            expected_alerts=[
+                types.FiringAlert(
+                    labels={
+                        "alertname": "threshold_below_at_least_once",
+                        "threshold.name": "critical",
+                    }
+                ),
+            ],
+        ),
+    ),
+    types.AlertTestCase(
+        name="test_threshold_below_all_the_time",
+        rule_path="alerts/test_scenarios/threshold_below_all_the_time/rule.json",
+        alert_data=[
+            types.AlertData(
+                type="logs",
+                data_path="alerts/test_scenarios/threshold_below_all_the_time/alert_data.jsonl",
+            ),
+        ],
+        alert_expectation=types.AlertExpectation(
+            should_alert=True,
+            wait_time_seconds=30,
+            expected_alerts=[
+                types.FiringAlert(
+                    labels={
+                        "alertname": "threshold_below_all_the_time",
+                        "threshold.name": "critical",
+                    }
+                ),
+            ],
+        ),
+    ),
+    types.AlertTestCase(
+        name="test_threshold_below_in_total",
+        rule_path="alerts/test_scenarios/threshold_below_in_total/rule.json",
+        alert_data=[
+            types.AlertData(
+                type="metrics",
+                data_path="alerts/test_scenarios/threshold_below_in_total/alert_data.jsonl",
+            ),
+        ],
+        alert_expectation=types.AlertExpectation(
+            should_alert=True,
+            wait_time_seconds=30,
+            expected_alerts=[
+                types.FiringAlert(
+                    labels={
+                        "alertname": "threshold_below_in_total",
+                        "threshold.name": "critical",
+                    }
+                ),
+            ],
+        ),
+    ),
+    types.AlertTestCase(
+        name="test_threshold_below_average",
+        rule_path="alerts/test_scenarios/threshold_below_average/rule.json",
+        alert_data=[
+            types.AlertData(
+                type="metrics",
+                data_path="alerts/test_scenarios/threshold_below_average/alert_data.jsonl",
+            ),
+        ],
+        alert_expectation=types.AlertExpectation(
+            should_alert=True,
+            wait_time_seconds=30,
+            expected_alerts=[
+                types.FiringAlert(
+                    labels={
+                        "alertname": "threshold_below_average",
+                        "threshold.name": "critical",
+                    }
+                ),
+            ],
+        ),
+    ),
+    # TODO: @abhishekhugetech enable the test for matchType last,
+    # after the [issue](https://github.com/SigNoz/engineering-pod/issues/3801) with matchType last is fixed, pylint: disable=W0511
+    # types.AlertTestCase(
+    #     name="test_threshold_below_last",
+    #     rule_path="alerts/test_scenarios/threshold_below_last/rule.json",
+    #     alert_data=[
+    #         types.AlertData(
+    #             type="metrics",
+    #             data_path="alerts/test_scenarios/threshold_below_last/alert_data.jsonl",
+    #         ),
+    #     ],
+    #     alert_expectation=types.AlertExpectation(
+    #         should_alert=True,
+    #         wait_time_seconds=30,
+    #         expected_alerts=[
+    #             types.FiringAlert(
+    #                 labels={
+    #                     "alertname": "threshold_below_last",
+    #                     "threshold.name": "critical",
+    #                 }
+    #             ),
+    #         ],
+    #     ),
+    # ),
+    types.AlertTestCase(
+        name="test_threshold_equal_to_at_least_once",
+        rule_path="alerts/test_scenarios/threshold_equal_to_at_least_once/rule.json",
+        alert_data=[
+            types.AlertData(
+                type="metrics",
+                data_path="alerts/test_scenarios/threshold_equal_to_at_least_once/alert_data.jsonl",
+            ),
+        ],
+        alert_expectation=types.AlertExpectation(
+            should_alert=True,
+            wait_time_seconds=30,
+            expected_alerts=[
+                types.FiringAlert(
+                    labels={
+                        "alertname": "threshold_equal_to_at_least_once",
+                        "threshold.name": "critical",
+                    }
+                ),
+            ],
+        ),
+    ),
+    types.AlertTestCase(
+        name="test_threshold_equal_to_all_the_time",
+        rule_path="alerts/test_scenarios/threshold_equal_to_all_the_time/rule.json",
+        alert_data=[
+            types.AlertData(
+                type="metrics",
+                data_path="alerts/test_scenarios/threshold_equal_to_all_the_time/alert_data.jsonl",
+            ),
+        ],
+        alert_expectation=types.AlertExpectation(
+            should_alert=True,
+            wait_time_seconds=30,
+            expected_alerts=[
+                types.FiringAlert(
+                    labels={
+                        "alertname": "threshold_equal_to_all_the_time",
+                        "threshold.name": "critical",
+                    }
+                ),
+            ],
+        ),
+    ),
+    types.AlertTestCase(
+        name="test_threshold_equal_to_in_total",
+        rule_path="alerts/test_scenarios/threshold_equal_to_in_total/rule.json",
+        alert_data=[
+            types.AlertData(
+                type="metrics",
+                data_path="alerts/test_scenarios/threshold_equal_to_in_total/alert_data.jsonl",
+            ),
+        ],
+        alert_expectation=types.AlertExpectation(
+            should_alert=True,
+            wait_time_seconds=30,
+            expected_alerts=[
+                types.FiringAlert(
+                    labels={
+                        "alertname": "threshold_equal_to_in_total",
+                        "threshold.name": "critical",
+                    }
+                ),
+            ],
+        ),
+    ),
+    types.AlertTestCase(
+        name="test_threshold_equal_to_average",
+        rule_path="alerts/test_scenarios/threshold_equal_to_average/rule.json",
+        alert_data=[
+            types.AlertData(
+                type="metrics",
+                data_path="alerts/test_scenarios/threshold_equal_to_average/alert_data.jsonl",
+            ),
+        ],
+        alert_expectation=types.AlertExpectation(
+            should_alert=True,
+            wait_time_seconds=30,
+            expected_alerts=[
+                types.FiringAlert(
+                    labels={
+                        "alertname": "threshold_equal_to_average",
+                        "threshold.name": "critical",
+                    }
+                ),
+            ],
+        ),
+    ),
+    # TODO: @abhishekhugetech enable the test for matchType last,
+    # after the [issue](https://github.com/SigNoz/engineering-pod/issues/3801) with matchType last is fixed, pylint: disable=W0511
+    # types.AlertTestCase(
+    #     name="test_threshold_equal_to_last",
+    #     rule_path="alerts/test_scenarios/threshold_equal_to_last/rule.json",
+    #     alert_data=[
+    #         types.AlertData(
+    #             type="metrics",
+    #             data_path="alerts/test_scenarios/threshold_equal_to_last/alert_data.jsonl",
+    #         ),
+    #     ],
+    #     alert_expectation=types.AlertExpectation(
+    #         should_alert=True,
+    #         wait_time_seconds=30,
+    #         expected_alerts=[
+    #             types.FiringAlert(
+    #                 labels={
+    #                     "alertname": "threshold_equal_to_last",
+    #                     "threshold.name": "critical",
+    #                 }
+    #             ),
+    #         ],
+    #     ),
+    # ),
+    types.AlertTestCase(
+        name="test_threshold_not_equal_to_at_least_once",
+        rule_path="alerts/test_scenarios/threshold_not_equal_to_at_least_once/rule.json",
+        alert_data=[
+            types.AlertData(
+                type="metrics",
+                data_path="alerts/test_scenarios/threshold_not_equal_to_at_least_once/alert_data.jsonl",
+            ),
+        ],
+        alert_expectation=types.AlertExpectation(
+            should_alert=True,
+            wait_time_seconds=30,
+            expected_alerts=[
+                types.FiringAlert(
+                    labels={
+                        "alertname": "threshold_not_equal_to_at_least_once",
+                        "threshold.name": "critical",
+                    }
+                ),
+            ],
+        ),
+    ),
+    types.AlertTestCase(
+        name="test_threshold_not_equal_to_all_the_time",
+        rule_path="alerts/test_scenarios/threshold_not_equal_to_all_the_time/rule.json",
+        alert_data=[
+            types.AlertData(
+                type="metrics",
+                data_path="alerts/test_scenarios/threshold_not_equal_to_all_the_time/alert_data.jsonl",
+            ),
+        ],
+        alert_expectation=types.AlertExpectation(
+            should_alert=True,
+            wait_time_seconds=30,
+            expected_alerts=[
+                types.FiringAlert(
+                    labels={
+                        "alertname": "threshold_not_equal_to_all_the_time",
+                        "threshold.name": "critical",
+                    }
+                ),
+            ],
+        ),
+    ),
+    types.AlertTestCase(
+        name="test_threshold_not_equal_to_in_total",
+        rule_path="alerts/test_scenarios/threshold_not_equal_to_in_total/rule.json",
+        alert_data=[
+            types.AlertData(
+                type="metrics",
+                data_path="alerts/test_scenarios/threshold_not_equal_to_in_total/alert_data.jsonl",
+            ),
+        ],
+        alert_expectation=types.AlertExpectation(
+            should_alert=True,
+            wait_time_seconds=30,
+            expected_alerts=[
+                types.FiringAlert(
+                    labels={
+                        "alertname": "threshold_not_equal_to_in_total",
+                        "threshold.name": "critical",
+                    }
+                ),
+            ],
+        ),
+    ),
+    types.AlertTestCase(
+        name="test_threshold_not_equal_to_average",
+        rule_path="alerts/test_scenarios/threshold_not_equal_to_average/rule.json",
+        alert_data=[
+            types.AlertData(
+                type="metrics",
+                data_path="alerts/test_scenarios/threshold_not_equal_to_average/alert_data.jsonl",
+            ),
+        ],
+        alert_expectation=types.AlertExpectation(
+            should_alert=True,
+            wait_time_seconds=30,
+            expected_alerts=[
+                types.FiringAlert(
+                    labels={
+                        "alertname": "threshold_not_equal_to_average",
+                        "threshold.name": "critical",
+                    }
+                ),
+            ],
+        ),
+    ),
+    # TODO: @abhishekhugetech enable the test for matchType last,
+    # after the [issue](https://github.com/SigNoz/engineering-pod/issues/3801) with matchType last is fixed, pylint: disable=W0511
+    # types.AlertTestCase(
+    #     name="test_threshold_not_equal_to_last",
+    #     rule_path="alerts/test_scenarios/threshold_not_equal_to_last/rule.json",
+    #     alert_data=[
+    #         types.AlertData(
+    #             type="metrics",
+    #             data_path="alerts/test_scenarios/threshold_not_equal_to_last/alert_data.jsonl",
+    #         ),
+    #     ],
+    #     alert_expectation=types.AlertExpectation(
+    #         should_alert=True,
+    #         wait_time_seconds=30,
+    #         expected_alerts=[
+    #             types.FiringAlert(
+    #                 labels={
+    #                     "alertname": "threshold_not_equal_to_last",
+    #                     "threshold.name": "critical",
+    #                 }
+    #             ),
+    #         ],
+    #     ),
+    # ),
+]
+
+# test cases unit conversion
+TEST_RULES_UNIT_CONVERSION = [
+    types.AlertTestCase(
+        name="test_unit_conversion_bytes_to_mb",
+        rule_path="alerts/test_scenarios/unit_conversion_bytes_to_mb/rule.json",
+        alert_data=[
+            types.AlertData(
+                type="metrics",
+                data_path="alerts/test_scenarios/unit_conversion_bytes_to_mb/alert_data.jsonl",
+            ),
+        ],
+        alert_expectation=types.AlertExpectation(
+            should_alert=True,
+            wait_time_seconds=30,
+            expected_alerts=[
+                types.FiringAlert(
+                    labels={
+                        "alertname": "unit_conversion_bytes_to_mb",
+                        "threshold.name": "critical",
+                    }
+                ),
+            ],
+        ),
+    ),
+    types.AlertTestCase(
+        name="test_unit_conversion_ms_to_second",
+        rule_path="alerts/test_scenarios/unit_conversion_ms_to_second/rule.json",
+        alert_data=[
+            types.AlertData(
+                type="metrics",
+                data_path="alerts/test_scenarios/unit_conversion_ms_to_second/alert_data.jsonl",
+            ),
+        ],
+        alert_expectation=types.AlertExpectation(
+            should_alert=True,
+            wait_time_seconds=30,
+            expected_alerts=[
+                types.FiringAlert(
+                    labels={
+                        "alertname": "unit_conversion_ms_to_second",
+                        "threshold.name": "critical",
+                    }
+                ),
+            ],
+        ),
+    ),
+]
+
+# test cases miscellaneous cases, no data and multi threshold
+TEST_RULES_MISCELLANEOUS = [
+    types.AlertTestCase(
+        name="test_no_data_rule_test",
+        rule_path="alerts/test_scenarios/no_data_rule_test/rule.json",
+        alert_data=[
+            types.AlertData(
+                type="metrics",
+                data_path="alerts/test_scenarios/no_data_rule_test/alert_data.jsonl",
+            ),
+        ],
+        alert_expectation=types.AlertExpectation(
+            should_alert=True,
+            wait_time_seconds=30,
+            expected_alerts=[
+                types.FiringAlert(
+                    labels={
+                        "alertname": "[No data] no_data_rule_test",
+                        "nodata": "true",
+                    }
+                ),
+            ],
+        ),
+    ),
+    # TODO: @abhishekhugetech enable the test for multi threshold rule, pylint: disable=W0511
+    # after the [issue](https://github.com/SigNoz/engineering-pod/issues/3934) with alertManager is resolved
+    # types.AlertTestCase(
+    #     name="test_multi_threshold_rule_test",
+    #     rule_path="alerts/test_scenarios/multi_threshold_rule_test/rule.json",
+    #     alert_data=[
+    #         types.AlertData(
+    #             type="metrics",
+    #             data_path="alerts/test_scenarios/multi_threshold_rule_test/alert_data.jsonl",
+    #         ),
+    #     ],
+    #     alert_expectation=types.AlertExpectation(
+    #         should_alert=True,
+    #         # the second alert will be fired with some delay from alert manager's group_interval
+    #         # so taking this in consideration, the wait time is 90 seconds (30s + 30s for next alert + 30s buffer)
+    #         wait_time_seconds=90,
+    #         expected_alerts=[
+    #             types.FiringAlert(
+    #                 labels={
+    #                     "alertname": "multi_threshold_rule_test",
+    #                     "threshold.name": "info",
+    #                 }
+    #             ),
+    #             types.FiringAlert(
+    #                 labels={
+    #                     "alertname": "multi_threshold_rule_test",
+    #                     "threshold.name": "warning",
+    #                 }
+    #             ),
+    #         ],
+    #     ),
+    # ),
+]
+
+
+logger = setup_logger(__name__)
+
+
+@pytest.mark.parametrize(
+    "alert_test_case",
+    TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS
+    + TEST_RULES_UNIT_CONVERSION
+    + TEST_RULES_MISCELLANEOUS,
+    ids=lambda alert_test_case: alert_test_case.name,
+)
+def test_basic_alert_rule_conditions(
+    # Notification channel related fixtures
+    notification_channel: types.TestContainerDocker,
+    make_http_mocks: Callable[[types.TestContainerDocker, List[Mapping]], None],
+    create_webhook_notification_channel: Callable[[str, str, dict, bool], str],
+    # Alert rule related fixtures
+    create_alert_rule: Callable[[dict], str],
+    # Alert data insertion related fixtures
+    insert_alert_data: Callable[[List[types.AlertData], datetime], None],
+    alert_test_case: types.AlertTestCase,
+):
+    # Prepare notification channel name and webhook endpoint
+    notification_channel_name = str(uuid.uuid4())
+    webhook_endpoint_path = f"/alert/{notification_channel_name}"
+    notification_url = notification_channel.container_configs["8080"].get(
+        webhook_endpoint_path
+    )
+
+    logger.info("notification_url: %s", {"notification_url": notification_url})
+
+    # register the mock endpoint in notification channel
+    make_http_mocks(
+        notification_channel,
+        [
+            Mapping(
+                request=MappingRequest(
+                    method=HttpMethods.POST,
+                    url=webhook_endpoint_path,
+                ),
+                response=MappingResponse(
+                    status=200,
+                    json_body={},
+                ),
+                persistent=False,
+            )
+        ],
+    )
+
+    # Create an alert channel using the given route
+    create_webhook_notification_channel(
+        channel_name=notification_channel_name,
+        webhook_url=notification_url,
+        http_config={},
+        send_resolved=False,
+    )
+
+    logger.info(
+        "alert channel created with name: %s",
+        {"notification_channel_name": notification_channel_name},
+    )
+
+    # Insert alert data
+    insert_alert_data(
+        alert_test_case.alert_data,
+        base_time=datetime.now(tz=timezone.utc) - timedelta(minutes=5),
+    )
+
+    # Create Alert Rule
+    rule_path = get_testdata_file_path(alert_test_case.rule_path)
+    with open(rule_path, "r", encoding="utf-8") as f:
+        rule_data = json.loads(f.read())
+    # Update the channel name in the rule data
+    update_rule_channel_name(rule_data, notification_channel_name)
+    rule_id = create_alert_rule(rule_data)
+    logger.info(
+        "rule created with id: %s",
+        {"rule_id": rule_id, "rule_name": rule_data["alert"]},
+    )
+
+    # Verify alert expectation
+    verify_webhook_alert_expectation(
+        notification_channel,
+        notification_channel_name,
+        alert_test_case.alert_expectation,
+    )

tests/integration/src/cloudintegrations/02_generate_connection_url.py

@@ -1,7 +1,6 @@
 from http import HTTPStatus
 from typing import Callable
 
-import pytest
 import requests
 
 from fixtures import types
@@ -21,7 +20,9 @@ def test_generate_connection_url(
     # Get authentication token for admin user
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
     cloud_provider = "aws"
-    endpoint = f"/api/v1/cloud-integrations/{cloud_provider}/accounts/generate-connection-url"
+    endpoint = (
+        f"/api/v1/cloud-integrations/{cloud_provider}/accounts/generate-connection-url"
+    )
 
     # Prepare request payload
     request_payload = {
@@ -65,9 +66,7 @@ def test_generate_connection_url(
     data = response_data["data"]
 
     # Assert account_id is a valid UUID format
-    assert (
-        len(data["account_id"]) > 0
-    ), "account_id should be a non-empty string (UUID)"
+    assert len(data["account_id"]) > 0, "account_id should be a non-empty string (UUID)"
 
     # Assert connection_url contains expected CloudFormation parameters
     connection_url = data["connection_url"]
@@ -111,7 +110,9 @@ def test_generate_connection_url_unsupported_provider(
     # Try with GCP (unsupported)
     cloud_provider = "gcp"
 
-    endpoint = f"/api/v1/cloud-integrations/{cloud_provider}/accounts/generate-connection-url"
+    endpoint = (
+        f"/api/v1/cloud-integrations/{cloud_provider}/accounts/generate-connection-url"
+    )
 
     request_payload = {
         "account_config": {"regions": ["us-central1"]},

tests/integration/src/cloudintegrations/03_accounts.py

@@ -1,17 +1,13 @@
+import uuid
 from http import HTTPStatus
 from typing import Callable
-import uuid
 
-import pytest
 import requests
 
 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
-from fixtures.logger import setup_logger
-from fixtures.cloudintegrations import (
-    create_cloud_integration_account,
-)
 from fixtures.cloudintegrationsutils import simulate_agent_checkin
+from fixtures.logger import setup_logger
 
 logger = setup_logger(__name__)
 
@@ -40,8 +36,9 @@ def test_list_connected_accounts_empty(
     data = response_data.get("data", response_data)
     assert "accounts" in data, "Response should contain 'accounts' field"
     assert isinstance(data["accounts"], list), "Accounts should be a list"
-    assert len(data["accounts"]) == 0, "Accounts list should be empty when no accounts are connected"
-
+    assert (
+        len(data["accounts"]) == 0
+    ), "Accounts list should be empty when no accounts are connected"
 
 
 def test_list_connected_accounts_with_account(
@@ -60,7 +57,9 @@ def test_list_connected_accounts_with_account(
 
     # Simulate agent check-in to mark as connected
     cloud_account_id = str(uuid.uuid4())
-    simulate_agent_checkin(signoz, admin_token, cloud_provider, account_id, cloud_account_id)
+    simulate_agent_checkin(
+        signoz, admin_token, cloud_provider, account_id, cloud_account_id
+    )
 
     # List accounts
     endpoint = f"/api/v1/cloud-integrations/{cloud_provider}/accounts"
@@ -87,7 +86,6 @@ def test_list_connected_accounts_with_account(
     assert "status" in account, "Account should have status field"
 
 
-
 def test_get_account_status(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
@@ -163,16 +161,16 @@ def test_update_account_config(
 
     # Simulate agent check-in to mark as connected
     cloud_account_id = str(uuid.uuid4())
-    simulate_agent_checkin(signoz, admin_token, cloud_provider, account_id, cloud_account_id)
+    simulate_agent_checkin(
+        signoz, admin_token, cloud_provider, account_id, cloud_account_id
+    )
 
     # Update account configuration
     endpoint = (
         f"/api/v1/cloud-integrations/{cloud_provider}/accounts/{account_id}/config"
     )
 
-    updated_config = {
-        "config": {"regions": ["us-east-1", "us-west-2", "eu-west-1"]}
-    }
+    updated_config = {"config": {"regions": ["us-east-1", "us-west-2", "eu-west-1"]}}
 
     response = requests.post(
         signoz.self.host_configs["8080"].get(endpoint),
@@ -198,7 +196,6 @@ def test_update_account_config(
         timeout=10,
     )
 
-
     list_response_data = list_response.json()
     list_data = list_response_data.get("data", list_response_data)
     account = next((a for a in list_data["accounts"] if a["id"] == account_id), None)
@@ -213,7 +210,6 @@ def test_update_account_config(
     }, "Regions should match updated config"
 
 
-
 def test_disconnect_account(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
@@ -230,7 +226,9 @@ def test_disconnect_account(
 
     # Simulate agent check-in to mark as connected
     cloud_account_id = str(uuid.uuid4())
-    simulate_agent_checkin(signoz, admin_token, cloud_provider, account_id, cloud_account_id)
+    simulate_agent_checkin(
+        signoz, admin_token, cloud_provider, account_id, cloud_account_id
+    )
 
     # Disconnect the account
     endpoint = (
@@ -262,8 +260,9 @@ def test_disconnect_account(
     disconnected_account = next(
         (a for a in list_data["accounts"] if a["id"] == account_id), None
     )
-    assert disconnected_account is None, f"Account {account_id} should be removed from connected accounts"
-
+    assert (
+        disconnected_account is None
+    ), f"Account {account_id} should be removed from connected accounts"
 
 
 def test_disconnect_account_not_found(
@@ -277,9 +276,7 @@ def test_disconnect_account_not_found(
     cloud_provider = "aws"
     fake_account_id = "00000000-0000-0000-0000-000000000000"
 
-    endpoint = (
-        f"/api/v1/cloud-integrations/{cloud_provider}/accounts/{fake_account_id}/disconnect"
-    )
+    endpoint = f"/api/v1/cloud-integrations/{cloud_provider}/accounts/{fake_account_id}/disconnect"
 
     response = requests.post(
         signoz.self.host_configs["8080"].get(endpoint),
@@ -292,7 +289,6 @@ def test_disconnect_account_not_found(
     ), f"Expected 404, got {response.status_code}"
 
 
-
 def test_list_accounts_unsupported_provider(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument

tests/integration/src/cloudintegrations/04_services.py

@@ -1,17 +1,13 @@
+import uuid
 from http import HTTPStatus
 from typing import Callable
-import uuid
 
-import pytest
 import requests
 
 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
-from fixtures.logger import setup_logger
-from fixtures.cloudintegrations import (
-    create_cloud_integration_account,
-)
 from fixtures.cloudintegrationsutils import simulate_agent_checkin
+from fixtures.logger import setup_logger
 
 logger = setup_logger(__name__)
 
@@ -50,7 +46,6 @@ def test_list_services_without_account(
     assert "icon" in service, "Service should have 'icon' field"
 
 
-
 def test_list_services_with_account(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
@@ -66,7 +61,9 @@ def test_list_services_with_account(
     account_id = account_data["account_id"]
 
     cloud_account_id = str(uuid.uuid4())
-    simulate_agent_checkin(signoz, admin_token, cloud_provider, account_id, cloud_account_id)
+    simulate_agent_checkin(
+        signoz, admin_token, cloud_provider, account_id, cloud_account_id
+    )
 
     # List services for the account
     endpoint = f"/api/v1/cloud-integrations/{cloud_provider}/services?cloud_account_id={cloud_account_id}"
@@ -94,7 +91,6 @@ def test_list_services_with_account(
     assert "icon" in service, "Service should have 'icon' field"
 
 
-
 def test_get_service_details_without_account(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
@@ -141,7 +137,6 @@ def test_get_service_details_without_account(
     assert isinstance(data["assets"], dict), "Assets should be a dictionary"
 
 
-
 def test_get_service_details_with_account(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
@@ -157,7 +152,9 @@ def test_get_service_details_with_account(
     account_id = account_data["account_id"]
 
     cloud_account_id = str(uuid.uuid4())
-    simulate_agent_checkin(signoz, admin_token, cloud_provider, account_id, cloud_account_id)
+    simulate_agent_checkin(
+        signoz, admin_token, cloud_provider, account_id, cloud_account_id
+    )
 
     # Get list of services first
     list_endpoint = f"/api/v1/cloud-integrations/{cloud_provider}/services"
@@ -196,7 +193,6 @@ def test_get_service_details_with_account(
     assert "status" in data, "Config should have 'status' field"
 
 
-
 def test_get_service_details_invalid_service(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
@@ -220,7 +216,6 @@ def test_get_service_details_invalid_service(
     ), f"Expected 404, got {response.status_code}"
 
 
-
 def test_list_services_unsupported_provider(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
@@ -243,7 +238,6 @@ def test_list_services_unsupported_provider(
     ), f"Expected 400, got {response.status_code}"
 
 
-
 def test_update_service_config(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
@@ -259,7 +253,9 @@ def test_update_service_config(
     account_id = account_data["account_id"]
 
     cloud_account_id = str(uuid.uuid4())
-    simulate_agent_checkin(signoz, admin_token, cloud_provider, account_id, cloud_account_id)
+    simulate_agent_checkin(
+        signoz, admin_token, cloud_provider, account_id, cloud_account_id
+    )
 
     # Get list of services to pick a valid service ID
     list_endpoint = f"/api/v1/cloud-integrations/{cloud_provider}/services"
@@ -274,7 +270,9 @@ def test_update_service_config(
     service_id = list_data["services"][0]["id"]
 
     # Update service configuration
-    endpoint = f"/api/v1/cloud-integrations/{cloud_provider}/services/{service_id}/config"
+    endpoint = (
+        f"/api/v1/cloud-integrations/{cloud_provider}/services/{service_id}/config"
+    )
 
     config_payload = {
         "cloud_account_id": cloud_account_id,
@@ -306,7 +304,6 @@ def test_update_service_config(
     assert "logs" in data["config"], "Config should contain 'logs' field"
 
 
-
 def test_update_service_config_without_account(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
@@ -329,7 +326,9 @@ def test_update_service_config_without_account(
     service_id = list_data["services"][0]["id"]
 
     # Try to update config with non-existent account
-    endpoint = f"/api/v1/cloud-integrations/{cloud_provider}/services/{service_id}/config"
+    endpoint = (
+        f"/api/v1/cloud-integrations/{cloud_provider}/services/{service_id}/config"
+    )
 
     fake_cloud_account_id = str(uuid.uuid4())
     config_payload = {
@@ -351,7 +350,6 @@ def test_update_service_config_without_account(
     ), f"Expected 500 for non-existent account, got {response.status_code}"
 
 
-
 def test_update_service_config_invalid_service(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
@@ -367,11 +365,15 @@ def test_update_service_config_invalid_service(
     account_id = account_data["account_id"]
 
     cloud_account_id = str(uuid.uuid4())
-    simulate_agent_checkin(signoz, admin_token, cloud_provider, account_id, cloud_account_id)
+    simulate_agent_checkin(
+        signoz, admin_token, cloud_provider, account_id, cloud_account_id
+    )
 
     # Try to update config for invalid service
     fake_service_id = "non-existent-service"
-    endpoint = f"/api/v1/cloud-integrations/{cloud_provider}/services/{fake_service_id}/config"
+    endpoint = (
+        f"/api/v1/cloud-integrations/{cloud_provider}/services/{fake_service_id}/config"
+    )
 
     config_payload = {
         "cloud_account_id": cloud_account_id,
@@ -392,7 +394,6 @@ def test_update_service_config_invalid_service(
     ), f"Expected 404 for invalid service, got {response.status_code}"
 
 
-
 def test_update_service_config_disable_service(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
@@ -408,7 +409,9 @@ def test_update_service_config_disable_service(
     account_id = account_data["account_id"]
 
     cloud_account_id = str(uuid.uuid4())
-    simulate_agent_checkin(signoz, admin_token, cloud_provider, account_id, cloud_account_id)
+    simulate_agent_checkin(
+        signoz, admin_token, cloud_provider, account_id, cloud_account_id
+    )
 
     # Get a valid service
     list_endpoint = f"/api/v1/cloud-integrations/{cloud_provider}/services"
@@ -422,7 +425,9 @@ def test_update_service_config_disable_service(
     service_id = list_data["services"][0]["id"]
 
     # First enable the service
-    endpoint = f"/api/v1/cloud-integrations/{cloud_provider}/services/{service_id}/config"
+    endpoint = (
+        f"/api/v1/cloud-integrations/{cloud_provider}/services/{service_id}/config"
+    )
 
     enable_payload = {
         "cloud_account_id": cloud_account_id,

tests/integration/src/querier/07_metrics_multi_temporality.py

@@ -2,11 +2,11 @@
 Look at the multi_temporality_counters_1h.jsonl file for the relevant data
 """
 
-import os
+import random
 from datetime import datetime, timedelta, timezone
 from http import HTTPStatus
-import random
-from typing import Any, Callable, List
+from typing import Callable, List
+
 import pytest
 
 from fixtures import types
@@ -21,8 +21,13 @@ from fixtures.querier import (
 from fixtures.utils import get_testdata_file_path
 
 MULTI_TEMPORALITY_FILE = get_testdata_file_path("multi_temporality_counters_1h.jsonl")
-MULTI_TEMPORALITY_FILE_10h = get_testdata_file_path("multi_temporality_counters_10h.jsonl")
-MULTI_TEMPORALITY_FILE_24h = get_testdata_file_path("multi_temporality_counters_24h.jsonl")
+MULTI_TEMPORALITY_FILE_10h = get_testdata_file_path(
+    "multi_temporality_counters_10h.jsonl"
+)
+MULTI_TEMPORALITY_FILE_24h = get_testdata_file_path(
+    "multi_temporality_counters_24h.jsonl"
+)
+
 
 @pytest.mark.parametrize(
     "time_aggregation, expected_value_at_31st_minute, expected_value_at_32nd_minute, steady_value",
@@ -39,7 +44,7 @@ def test_with_steady_values_and_reset(
     time_aggregation: str,
     expected_value_at_31st_minute: float,
     expected_value_at_32nd_minute: float,
-    steady_value: float
+    steady_value: float,
 ) -> None:
     now = datetime.now(tz=timezone.utc).replace(second=0, microsecond=0)
     start_ms = int((now - timedelta(minutes=65)).timestamp() * 1000)
@@ -69,22 +74,21 @@ def test_with_steady_values_and_reset(
     result_values = sorted(get_series_values(data, "A"), key=lambda x: x["timestamp"])
     assert len(result_values) >= 59
     # the counter reset happened at 31st minute
-    assert (
-        result_values[30]["value"] == expected_value_at_31st_minute
-    )
-    assert (
-        result_values[31]["value"] == expected_value_at_32nd_minute
-    )
+    assert result_values[30]["value"] == expected_value_at_31st_minute
+    assert result_values[31]["value"] == expected_value_at_32nd_minute
     assert (
         result_values[39]["value"] == steady_value
-    ) # 39th minute is when cumulative shifts to delta
+    )  # 39th minute is when cumulative shifts to delta
     count_of_steady_rate = sum(1 for v in result_values if v["value"] == steady_value)
     assert (
         count_of_steady_rate >= 56
     )  # 59 - (1 reset + 1 high rate + 1 at the beginning)
     # All rates should be non-negative (stale periods = 0 rate)
     for v in result_values:
-        assert v["value"] >= 0, f"{time_aggregation} should not be negative: {v['value']}"
+        assert (
+            v["value"] >= 0
+        ), f"{time_aggregation} should not be negative: {v['value']}"
+
 
 @pytest.mark.parametrize(
     "time_aggregation, stable_health_value, stable_products_value, stable_checkout_value, spike_checkout_value, stable_orders_value, spike_users_value",
@@ -161,20 +165,26 @@ def test_group_by_endpoint(
     assert (
         len(health_values) >= 58
     ), f"Expected >= 58 values for /health, got {len(health_values)}"
-    count_steady_health = sum(1 for v in health_values if v["value"] == stable_health_value) 
+    count_steady_health = sum(
+        1 for v in health_values if v["value"] == stable_health_value
+    )
     assert (
         count_steady_health >= 57
     ), f"Expected >= 57 steady rate values ({stable_health_value}) for /health, got {count_steady_health}"
     # all /health rates should be state except possibly first/last due to boundaries
     for v in health_values[1:-1]:
-        assert v["value"] == stable_health_value, f"Expected /health rate {stable_health_value}, got {v['value']}"
+        assert (
+            v["value"] == stable_health_value
+        ), f"Expected /health rate {stable_health_value}, got {v['value']}"
 
     # /products: 51 data points with 10-minute gap (t20-t29 missing), steady +20/min
     products_values = endpoint_values["/products"]
     assert (
         len(products_values) >= 49
     ), f"Expected >= 49 values for /products, got {len(products_values)}"
-    count_steady_products = sum(1 for v in products_values if v["value"] == stable_products_value)
+    count_steady_products = sum(
+        1 for v in products_values if v["value"] == stable_products_value
+    )
 
     # most values should be stable, some boundary values differ due to 10-min gap
     assert (
@@ -182,7 +192,9 @@ def test_group_by_endpoint(
     ), f"Expected >= 46 steady rate values ({stable_products_value}) for /products, got {count_steady_products}"
 
     # check that non-stable values are due to gap averaging (should be lower)
-    gap_boundary_values = [v["value"] for v in products_values if v["value"] != stable_products_value]
+    gap_boundary_values = [
+        v["value"] for v in products_values if v["value"] != stable_products_value
+    ]
     for val in gap_boundary_values:
         assert (
             0 < val < stable_products_value
@@ -193,12 +205,16 @@ def test_group_by_endpoint(
     assert (
         len(checkout_values) >= 59
     ), f"Expected >= 59 values for /checkout, got {len(checkout_values)}"
-    count_steady_checkout = sum(1 for v in checkout_values if v["value"] == stable_checkout_value)
+    count_steady_checkout = sum(
+        1 for v in checkout_values if v["value"] == stable_checkout_value
+    )
     assert (
         count_steady_checkout >= 53
     ), f"Expected >= 53 steady {time_aggregation} values ({stable_checkout_value}) for /checkout, got {count_steady_checkout}"
     # check that spike values exist (traffic spike +50/min at t40-t44)
-    count_spike_checkout = sum(1 for v in checkout_values if v["value"] == spike_checkout_value)
+    count_spike_checkout = sum(
+        1 for v in checkout_values if v["value"] == spike_checkout_value
+    )
     assert (
         count_spike_checkout >= 4
     ), f"Expected >= 4 spike {time_aggregation} values ({spike_checkout_value}) for /checkout, got {count_spike_checkout}"
@@ -220,12 +236,16 @@ def test_group_by_endpoint(
     assert (
         len(orders_values) >= 58
     ), f"Expected >= 58 values for /orders, got {len(orders_values)}"
-    count_steady_orders = sum(1 for v in orders_values if v["value"] == stable_orders_value)
+    count_steady_orders = sum(
+        1 for v in orders_values if v["value"] == stable_orders_value
+    )
     assert (
         count_steady_orders >= 55
     ), f"Expected >= 55 steady {time_aggregation} values ({stable_orders_value}) for /orders, got {count_steady_orders}"
     # check for counter reset effects - there should be some non-standard values
-    non_standard_orders = [v["value"] for v in orders_values if v["value"] != stable_orders_value]
+    non_standard_orders = [
+        v["value"] for v in orders_values if v["value"] != stable_orders_value
+    ]
     assert (
         len(non_standard_orders) >= 2
     ), f"Expected >= 2 non-standard values due to counter reset, got {non_standard_orders}"
@@ -252,6 +272,7 @@ def test_group_by_endpoint(
         count_increment_rate >= 8
     ), f"Expected >= 8 increment {time_aggregation} values ({spike_users_value}) for /users, got {count_increment_rate}"
 
+
 @pytest.mark.parametrize(
     "time_aggregation, expected_value_at_30th_minute, expected_value_at_31st_minute, value_at_switch",
     [
@@ -267,7 +288,7 @@ def test_for_service_with_switch(
     time_aggregation: str,
     expected_value_at_30th_minute: float,
     expected_value_at_31st_minute: float,
-    value_at_switch: float
+    value_at_switch: float,
 ) -> None:
     now = datetime.now(tz=timezone.utc).replace(second=0, microsecond=0)
     start_ms = int((now - timedelta(minutes=65)).timestamp() * 1000)
@@ -296,21 +317,18 @@ def test_for_service_with_switch(
     data = response.json()
     result_values = sorted(get_series_values(data, "A"), key=lambda x: x["timestamp"])
     assert len(result_values) >= 60
+    assert result_values[30]["value"] == expected_value_at_30th_minute  # 0.183
+    assert result_values[31]["value"] == expected_value_at_31st_minute  # 0.183
+    assert result_values[38]["value"] == value_at_switch  # 0.25
     assert (
-        result_values[30]["value"] == expected_value_at_30th_minute #0.183
-    ) 
-    assert (
-        result_values[31]["value"] == expected_value_at_31st_minute # 0.183
-    )
-    assert (
-        result_values[38]["value"] == value_at_switch # 0.25
-    ) 
-    assert (
-        result_values[39]["value"] == value_at_switch # 0.25
-    ) # 39th minute is when cumulative shifts to delta
+        result_values[39]["value"] == value_at_switch  # 0.25
+    )  # 39th minute is when cumulative shifts to delta
     # All rates should be non-negative (stale periods = 0 rate)
     for v in result_values:
-        assert v["value"] >= 0, f"{time_aggregation} should not be negative: {v['value']}"
+        assert (
+            v["value"] >= 0
+        ), f"{time_aggregation} should not be negative: {v['value']}"
+
 
 @pytest.mark.parametrize(
     "time_aggregation, expected_value",
@@ -355,6 +373,7 @@ def test_for_week_long_time_range(
     for value in result_values[1:]:
         assert value["value"] == expected_value
 
+
 @pytest.mark.parametrize(
     "time_aggregation, expected_value",
     [

tests/integration/src/role/01_register.py

@@ -1,23 +1,23 @@
-import pytest
 from http import HTTPStatus
 from typing import Callable
 
+import pytest
 import requests
 from sqlalchemy import sql
 
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
 from fixtures.types import Operation, SigNoz
 
-
 ANONYMOUS_USER_ID = "00000000-0000-0000-0000-000000000000"
 
+
 def test_managed_roles_create_on_register(
     signoz: SigNoz,
     create_user_admin: Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
 ):
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    
+
     # get the list of all roles.
     response = requests.get(
         signoz.self.host_configs["8080"].get("/api/v1/roles"),
@@ -32,18 +32,22 @@ def test_managed_roles_create_on_register(
     # since this check happens immediately post registeration, all the managed roles should be present.
     assert len(data) == 4
     role_names = {role["name"] for role in data}
-    expected_names = {"signoz-admin", "signoz-viewer", "signoz-editor", "signoz-anonymous"}
+    expected_names = {
+        "signoz-admin",
+        "signoz-viewer",
+        "signoz-editor",
+        "signoz-anonymous",
+    }
     # do the set mapping as this is order insensitive, direct list match is order-sensitive.
     assert set(role_names) == expected_names
 
 
-
 def test_root_user_signoz_admin_assignment(
     request: pytest.FixtureRequest,
     signoz: SigNoz,
     create_user_admin: Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
-):  
+):
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
     # Get the user from the /user/me endpoint and extract the id
@@ -64,14 +68,16 @@ def test_root_user_signoz_admin_assignment(
     # this validates to some extent that the role assignment is complete under the assumption that middleware is functioning as expected.
     assert response.status_code == HTTPStatus.OK
     assert response.json()["status"] == "success"
-    
+
     # Loop over the roles and get the org_id and id for signoz-admin role
     roles = response.json()["data"]
-    admin_role_entry = next((role for role in roles if role["name"] == "signoz-admin"), None)
+    admin_role_entry = next(
+        (role for role in roles if role["name"] == "signoz-admin"), None
+    )
     assert admin_role_entry is not None
     org_id = admin_role_entry["orgId"]
 
-    # to be super sure of authorization server, let's validate the tuples in DB as well. 
+    # to be super sure of authorization server, let's validate the tuples in DB as well.
     # todo[@vikrantgupta25]: replace this with role memebers handler once built.
     with signoz.sqlstore.conn.connect() as conn:
         # verify the entry present for role assignment
@@ -80,15 +86,14 @@ def test_root_user_signoz_admin_assignment(
             sql.text("SELECT * FROM tuple WHERE object_id = :object_id"),
             {"object_id": tuple_object_id},
         )
-        
+
         tuple_row = tuple_result.mappings().fetchone()
         assert tuple_row is not None
         # check that the tuple if for role assignment
-        assert tuple_row['object_type'] == "role"
-        assert tuple_row['relation'] == "assignee"
+        assert tuple_row["object_type"] == "role"
+        assert tuple_row["relation"] == "assignee"
 
-        
-        if request.config.getoption("--sqlstore-provider") == 'sqlite':
+        if request.config.getoption("--sqlstore-provider") == "sqlite":
             user_object_id = f"organization/{org_id}/user/{user_id}"
             assert tuple_row["user_object_type"] == "user"
             assert tuple_row["user_object_id"] == user_object_id
@@ -97,13 +102,13 @@ def test_root_user_signoz_admin_assignment(
             assert tuple_row["user_type"] == "user"
             assert tuple_row["_user"] == _user
 
-        
+
 def test_anonymous_user_signoz_anonymous_assignment(
     request: pytest.FixtureRequest,
     signoz: SigNoz,
     create_user_admin: Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
-):  
+):
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
     response = requests.get(
@@ -115,14 +120,16 @@ def test_anonymous_user_signoz_anonymous_assignment(
     # this validates to some extent that the role assignment is complete under the assumption that middleware is functioning as expected.
     assert response.status_code == HTTPStatus.OK
     assert response.json()["status"] == "success"
-    
+
     # Loop over the roles and get the org_id and id for signoz-admin role
     roles = response.json()["data"]
-    admin_role_entry = next((role for role in roles if role["name"] == "signoz-anonymous"), None)
+    admin_role_entry = next(
+        (role for role in roles if role["name"] == "signoz-anonymous"), None
+    )
     assert admin_role_entry is not None
     org_id = admin_role_entry["orgId"]
 
-    # to be super sure of authorization server, let's validate the tuples in DB as well. 
+    # to be super sure of authorization server, let's validate the tuples in DB as well.
     # todo[@vikrantgupta25]: replace this with role memebers handler once built.
     with signoz.sqlstore.conn.connect() as conn:
         # verify the entry present for role assignment
@@ -131,15 +138,14 @@ def test_anonymous_user_signoz_anonymous_assignment(
             sql.text("SELECT * FROM tuple WHERE object_id = :object_id"),
             {"object_id": tuple_object_id},
         )
-        
+
         tuple_row = tuple_result.mappings().fetchone()
         assert tuple_row is not None
         # check that the tuple if for role assignment
-        assert tuple_row['object_type'] == "role"
-        assert tuple_row['relation'] == "assignee"
+        assert tuple_row["object_type"] == "role"
+        assert tuple_row["relation"] == "assignee"
 
-        
-        if request.config.getoption("--sqlstore-provider") == 'sqlite':
+        if request.config.getoption("--sqlstore-provider") == "sqlite":
             user_object_id = f"organization/{org_id}/anonymous/{ANONYMOUS_USER_ID}"
             assert tuple_row["user_object_type"] == "anonymous"
             assert tuple_row["user_object_id"] == user_object_id
@@ -147,5 +153,3 @@ def test_anonymous_user_signoz_anonymous_assignment(
             _user = f"anonymous:organization/{org_id}/anonymous/{ANONYMOUS_USER_ID}"
             assert tuple_row["user_type"] == "user"
             assert tuple_row["_user"] == _user
-
-                

tests/integration/src/role/02_user.py

@@ -1,11 +1,16 @@
-import pytest
 from http import HTTPStatus
 from typing import Callable
 
+import pytest
 import requests
 from sqlalchemy import sql
 
-from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD, USER_EDITOR_EMAIL, USER_EDITOR_PASSWORD
+from fixtures.auth import (
+    USER_ADMIN_EMAIL,
+    USER_ADMIN_PASSWORD,
+    USER_EDITOR_EMAIL,
+    USER_EDITOR_PASSWORD,
+)
 from fixtures.types import Operation, SigNoz
 
 
@@ -16,7 +21,7 @@ def test_user_invite_accept_role_grant(
     get_token: Callable[[str, str], str],
 ):
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    
+
     # invite a user as editor
     invite_payload = {
         "email": USER_EDITOR_EMAIL,
@@ -30,7 +35,7 @@ def test_user_invite_accept_role_grant(
     )
     assert invite_response.status_code == HTTPStatus.CREATED
     invite_token = invite_response.json()["data"]["token"]
-    
+
     # accept the invite for editor
     accept_payload = {
         "token": invite_token,
@@ -40,7 +45,7 @@ def test_user_invite_accept_role_grant(
         signoz.self.host_configs["8080"].get("/api/v1/invite/accept"),
         json=accept_payload,
         timeout=2,
-    )    
+    )
     assert accept_response.status_code == HTTPStatus.CREATED
 
     # Login with editor email and password
@@ -53,7 +58,6 @@ def test_user_invite_accept_role_grant(
     assert user_me_response.status_code == HTTPStatus.OK
     editor_id = user_me_response.json()["data"]["id"]
 
-
     # check the forbidden response for admin api for editor user
     admin_roles_response = requests.get(
         signoz.self.host_configs["8080"].get("/api/v1/roles"),
@@ -79,11 +83,11 @@ def test_user_invite_accept_role_grant(
         )
         tuple_row = tuple_result.mappings().fetchone()
         assert tuple_row is not None
-        assert tuple_row['object_type'] == "role"
-        assert tuple_row['relation'] == "assignee"
+        assert tuple_row["object_type"] == "role"
+        assert tuple_row["relation"] == "assignee"
 
         # verify the user tuple details depending on db provider
-        if request.config.getoption("--sqlstore-provider") == 'sqlite':
+        if request.config.getoption("--sqlstore-provider") == "sqlite":
             user_object_id = f"organization/{org_id}/user/{editor_id}"
             assert tuple_row["user_object_type"] == "user"
             assert tuple_row["user_object_id"] == user_object_id
@@ -93,7 +97,6 @@ def test_user_invite_accept_role_grant(
             assert tuple_row["_user"] == _user
 
 
-
 def test_user_update_role_grant(
     request: pytest.FixtureRequest,
     signoz: SigNoz,
@@ -122,9 +125,7 @@ def test_user_update_role_grant(
     org_id = roles_data[0]["orgId"]
 
     # Update the user's role to viewer
-    update_payload = {
-        "role": "VIEWER"
-    }
+    update_payload = {"role": "VIEWER"}
     update_response = requests.put(
         signoz.self.host_configs["8080"].get(f"/api/v1/user/{editor_id}"),
         json=update_payload,
@@ -139,7 +140,9 @@ def test_user_update_role_grant(
         viewer_tuple_object_id = f"organization/{org_id}/role/signoz-viewer"
         # Check there is no tuple for signoz-editor assignment
         editor_tuple_result = conn.execute(
-            sql.text("SELECT * FROM tuple WHERE object_id = :object_id AND relation = 'assignee'"),
+            sql.text(
+                "SELECT * FROM tuple WHERE object_id = :object_id AND relation = 'assignee'"
+            ),
             {"object_id": editor_tuple_object_id},
         )
         for row in editor_tuple_result.mappings().fetchall():
@@ -152,13 +155,15 @@ def test_user_update_role_grant(
 
         # Check that a tuple exists for signoz-viewer assignment
         viewer_tuple_result = conn.execute(
-            sql.text("SELECT * FROM tuple WHERE object_id = :object_id AND relation = 'assignee'"),
+            sql.text(
+                "SELECT * FROM tuple WHERE object_id = :object_id AND relation = 'assignee'"
+            ),
             {"object_id": viewer_tuple_object_id},
         )
         row = viewer_tuple_result.mappings().fetchone()
         assert row is not None
-        assert row['object_type'] == "role"
-        assert row['relation'] == "assignee"
+        assert row["object_type"] == "role"
+        assert row["relation"] == "assignee"
         if request.config.getoption("--sqlstore-provider") == "sqlite":
             user_object_id = f"organization/{org_id}/user/{editor_id}"
             assert row["user_object_type"] == "user"
@@ -168,6 +173,7 @@ def test_user_update_role_grant(
             assert row["user_type"] == "user"
             assert row["_user"] == _user
 
+
 def test_user_delete_role_revoke(
     request: pytest.FixtureRequest,
     signoz: SigNoz,
@@ -205,10 +211,12 @@ def test_user_delete_role_revoke(
 
     with signoz.sqlstore.conn.connect() as conn:
         tuple_result = conn.execute(
-            sql.text("SELECT * FROM tuple WHERE object_id = :object_id AND relation = 'assignee'"),
+            sql.text(
+                "SELECT * FROM tuple WHERE object_id = :object_id AND relation = 'assignee'"
+            ),
             {"object_id": tuple_object_id},
         )
-        
+
         # there should NOT be any tuple for the current user assignment
         tuple_rows = tuple_result.mappings().fetchall()
         for row in tuple_rows:
@@ -217,4 +225,4 @@ def test_user_delete_role_revoke(
                 assert row["user_object_id"] != user_object_id
             else:
                 _user = f"user:organization/{org_id}/user/{editor_id}"
-                assert row["_user"] != _user
+                assert row["_user"] != _user

tests/integration/testdata/alerts/test_scenarios/multi_threshold_rule_test/alert_data.jsonl

@@ -0,0 +1,12 @@
+{"metric_name":"cpu_percent_multi_threshold_rule_test","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:01:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_multi_threshold_rule_test","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:02:00+00:00","value":15,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_multi_threshold_rule_test","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:03:00+00:00","value":14,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_multi_threshold_rule_test","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:04:00+00:00","value":3,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_multi_threshold_rule_test","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:05:00+00:00","value":6,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_multi_threshold_rule_test","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:06:00+00:00","value":25,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_multi_threshold_rule_test","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:07:00+00:00","value":25,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_multi_threshold_rule_test","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:08:00+00:00","value":25,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_multi_threshold_rule_test","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:09:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_multi_threshold_rule_test","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:10:00+00:00","value":12,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_multi_threshold_rule_test","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:11:00+00:00","value":8,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_multi_threshold_rule_test","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:12:00+00:00","value":15,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/multi_threshold_rule_test/rule.json

@@ -0,0 +1,83 @@
+{
+  "alert": "multi_threshold_rule_test",
+  "ruleType": "threshold_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 30,
+          "matchType": "1",
+          "op": "1",
+          "channels": [
+            "test channel"
+          ]
+        },
+        {
+          "name": "warning",
+          "target": 20,
+          "matchType": "1",
+          "op": "1",
+          "channels": [
+            "test channel"
+          ]
+        },
+        {
+          "name": "info",
+          "target": 10,
+          "matchType": "1",
+          "op": "1",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "metrics",
+            "aggregations": [
+              {
+                "metricName": "cpu_percent_multi_threshold_rule_test",
+                "timeAggregation": "avg",
+                "spaceAggregation": "max"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/no_data_rule_test/alert_data.jsonl

@@ -0,0 +1,12 @@
+{"metric_name":"request_total_no_data_rule_test","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:01:00+00:00","value":12,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_no_data_rule_test","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:02:00+00:00","value":26,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_no_data_rule_test","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:03:00+00:00","value":41,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_no_data_rule_test","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:04:00+00:00","value":56,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_no_data_rule_test","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:05:00+00:00","value":71,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_no_data_rule_test","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:06:00+00:00","value":86,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_no_data_rule_test","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:07:00+00:00","value":101,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_no_data_rule_test","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:08:00+00:00","value":116,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_no_data_rule_test","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:09:00+00:00","value":131,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_no_data_rule_test","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:10:00+00:00","value":146,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_no_data_rule_test","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:11:00+00:00","value":161,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_no_data_rule_test","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:12:00+00:00","value":176,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/no_data_rule_test/rule.json

@@ -0,0 +1,70 @@
+{
+  "alert": "no_data_rule_test",
+  "ruleType": "threshold_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 10,
+          "matchType": "1",
+          "op": "1",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "metrics",
+            "filter": {
+              "expression": "service = 'server'"
+            },
+            "aggregations": [
+              {
+                "metricName": "request_total_no_data_rule_test",
+                "timeAggregation": "rate",
+                "spaceAggregation": "sum"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A",
+    "alertOnAbsent": true,
+    "absentFor": 1
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/threshold_above_all_the_time/alert_data.jsonl

@@ -0,0 +1,12 @@
+{"metric_name":"cpu_percent_threshold_above_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:01:00+00:00","value":12,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_above_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:02:00+00:00","value":14,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_above_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:03:00+00:00","value":15,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_above_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:04:00+00:00","value":15,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_above_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:05:00+00:00","value":15,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_above_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:06:00+00:00","value":15,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_above_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:07:00+00:00","value":15,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_above_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:08:00+00:00","value":15,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_above_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:09:00+00:00","value":15,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_above_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:10:00+00:00","value":15,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_above_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:11:00+00:00","value":15,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_above_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:12:00+00:00","value":15,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/threshold_above_all_the_time/rule.json

@@ -0,0 +1,58 @@
+{
+  "alert": "threshold_above_all_the_time",
+  "ruleType": "promql_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 10,
+          "matchType": "2",
+          "op": "1",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "promql",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "promql",
+          "spec": {
+            "name": "A",
+            "query": "{\"cpu_percent_threshold_above_all_the_time\"}"
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/threshold_above_at_least_once/alert_data.jsonl

@@ -0,0 +1,12 @@
+{"metric_name":"request_total_threshold_above_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:01:00+00:00","value":1,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:02:00+00:00","value":2,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:03:00+00:00","value":3,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:04:00+00:00","value":4,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:05:00+00:00","value":19,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:06:00+00:00","value":20,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:07:00+00:00","value":35,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:08:00+00:00","value":36,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:09:00+00:00","value":37,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:10:00+00:00","value":38,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:11:00+00:00","value":39,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:12:00+00:00","value":40,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/threshold_above_at_least_once/rule.json

@@ -0,0 +1,58 @@
+{
+  "alert": "threshold_above_at_least_once",
+  "ruleType": "threshold_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 10,
+          "matchType": "1",
+          "op": "1",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "clickhouse_sql",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "clickhouse_sql",
+          "spec": {
+            "name": "A",
+            "query": "WITH __temporal_aggregation_cte AS (\n SELECT \n fingerprint, \n toStartOfInterval(toDateTime(intDiv(unix_milli, 1000)), toIntervalSecond(60)) AS ts, \n avg(value) AS per_series_value \n FROM signoz_metrics.distributed_samples_v4 AS points \n INNER JOIN (\n SELECT fingerprint \n FROM signoz_metrics.time_series_v4 \n WHERE metric_name IN ('request_total_threshold_above_at_least_once') \n AND LOWER(temporality) LIKE LOWER('cumulative') \n AND __normalized = false \n GROUP BY fingerprint\n ) AS filtered_time_series ON points.fingerprint = filtered_time_series.fingerprint \n WHERE metric_name IN ('request_total_threshold_above_at_least_once') \n AND unix_milli >= {{.start_timestamp_ms}} \n AND unix_milli < {{.end_timestamp_ms}} \n GROUP BY fingerprint, ts \n ORDER BY fingerprint, ts\n), \n__spatial_aggregation_cte AS (\n SELECT \n ts, \n avg(per_series_value) AS value \n FROM __temporal_aggregation_cte \n WHERE isNaN(per_series_value) = 0 \n GROUP BY ts\n) \nSELECT * FROM __spatial_aggregation_cte \nORDER BY ts"
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/threshold_above_average/alert_data.jsonl

@@ -0,0 +1,20 @@
+{ "timestamp": "2026-01-29T10:00:00.000000Z", "duration": "PT0.8S", "trace_id": "491f6d3d6b0a1f9e8a71b2c3d4e5f6a1", "span_id": "a1b2c3d4e5f6g7h8", "parent_span_id": "", "name": "POST /order", "kind": 2, "status_code": 1, "status_message": "", "resources": { "deployment.environment": "production", "service.name": "order-service", "os.type": "linux", "host.name": "linux-000" }, "attributes": { "net.transport": "IP.TCP", "http.scheme": "http", "http.user_agent": "Integration Test", "http.request.method": "POST", "http.response.status_code": "200", "http.request.path": "/order" } }
+{ "timestamp": "2026-01-29T10:00:30.000000Z", "duration": "PT1.2S", "trace_id": "491f6d3d6b0a1f9e8a71b2c3d4e5f6a2", "span_id": "a2b3c4d5e6f7g8h9", "parent_span_id": "", "name": "POST /order", "kind": 2, "status_code": 1, "status_message": "", "resources": { "deployment.environment": "production", "service.name": "order-service", "os.type": "linux", "host.name": "linux-000" }, "attributes": { "net.transport": "IP.TCP", "http.scheme": "http", "http.user_agent": "Integration Test", "http.request.method": "POST", "http.response.status_code": "200", "http.request.path": "/order" } }
+{ "timestamp": "2026-01-29T10:01:00.000000Z", "duration": "PT0.9S", "trace_id": "491f6d3d6b0a1f9e8a71b2c3d4e5f6a3", "span_id": "a3b4c5d6e7f8g9h0", "parent_span_id": "", "name": "POST /order", "kind": 2, "status_code": 1, "status_message": "", "resources": { "deployment.environment": "production", "service.name": "order-service", "os.type": "linux", "host.name": "linux-000" }, "attributes": { "net.transport": "IP.TCP", "http.scheme": "http", "http.user_agent": "Integration Test", "http.request.method": "POST", "http.response.status_code": "200", "http.request.path": "/order" } }
+{ "timestamp": "2026-01-29T10:01:30.000000Z", "duration": "PT1.5S", "trace_id": "491f6d3d6b0a1f9e8a71b2c3d4e5f6a4", "span_id": "a4b5c6d7e8f9g0h1", "parent_span_id": "", "name": "POST /order", "kind": 2, "status_code": 1, "status_message": "", "resources": { "deployment.environment": "production", "service.name": "order-service", "os.type": "linux", "host.name": "linux-000" }, "attributes": { "net.transport": "IP.TCP", "http.scheme": "http", "http.user_agent": "Integration Test", "http.request.method": "POST", "http.response.status_code": "200", "http.request.path": "/order" } }
+{ "timestamp": "2026-01-29T10:02:00.000000Z", "duration": "PT1.1S", "trace_id": "491f6d3d6b0a1f9e8a71b2c3d4e5f6a5", "span_id": "a5b6c7d8e9f0g1h2", "parent_span_id": "", "name": "POST /order", "kind": 2, "status_code": 1, "status_message": "", "resources": { "deployment.environment": "production", "service.name": "order-service", "os.type": "linux", "host.name": "linux-000" }, "attributes": { "net.transport": "IP.TCP", "http.scheme": "http", "http.user_agent": "Integration Test", "http.request.method": "POST", "http.response.status_code": "200", "http.request.path": "/order" } }
+{ "timestamp": "2026-01-29T10:02:30.000000Z", "duration": "PT0.7S", "trace_id": "491f6d3d6b0a1f9e8a71b2c3d4e5f6a6", "span_id": "a6b7c8d9e0f1g2h3", "parent_span_id": "", "name": "POST /order", "kind": 2, "status_code": 1, "status_message": "", "resources": { "deployment.environment": "production", "service.name": "order-service", "os.type": "linux", "host.name": "linux-000" }, "attributes": { "net.transport": "IP.TCP", "http.scheme": "http", "http.user_agent": "Integration Test", "http.request.method": "POST", "http.response.status_code": "200", "http.request.path": "/order" } }
+{ "timestamp": "2026-01-29T10:03:00.000000Z", "duration": "PT1.8S", "trace_id": "491f6d3d6b0a1f9e8a71b2c3d4e5f6a7", "span_id": "a7b8c9d0e1f2g3h4", "parent_span_id": "", "name": "POST /order", "kind": 2, "status_code": 1, "status_message": "", "resources": { "deployment.environment": "production", "service.name": "order-service", "os.type": "linux", "host.name": "linux-000" }, "attributes": { "net.transport": "IP.TCP", "http.scheme": "http", "http.user_agent": "Integration Test", "http.request.method": "POST", "http.response.status_code": "200", "http.request.path": "/order" } }
+{ "timestamp": "2026-01-29T10:03:30.000000Z", "duration": "PT1.3S", "trace_id": "491f6d3d6b0a1f9e8a71b2c3d4e5f6a8", "span_id": "a8b9c0d1e2f3g4h5", "parent_span_id": "", "name": "POST /order", "kind": 2, "status_code": 1, "status_message": "", "resources": { "deployment.environment": "production", "service.name": "order-service", "os.type": "linux", "host.name": "linux-000" }, "attributes": { "net.transport": "IP.TCP", "http.scheme": "http", "http.user_agent": "Integration Test", "http.request.method": "POST", "http.response.status_code": "200", "http.request.path": "/order" } }
+{ "timestamp": "2026-01-29T10:04:00.000000Z", "duration": "PT0.6S", "trace_id": "491f6d3d6b0a1f9e8a71b2c3d4e5f6a9", "span_id": "a9b0c1d2e3f4g5h6", "parent_span_id": "", "name": "POST /order", "kind": 2, "status_code": 1, "status_message": "", "resources": { "deployment.environment": "production", "service.name": "order-service", "os.type": "linux", "host.name": "linux-000" }, "attributes": { "net.transport": "IP.TCP", "http.scheme": "http", "http.user_agent": "Integration Test", "http.request.method": "POST", "http.response.status_code": "200", "http.request.path": "/order" } }
+{ "timestamp": "2026-01-29T10:04:30.000000Z", "duration": "PT1.4S", "trace_id": "491f6d3d6b0a1f9e8a71b2c3d4e5f6b1", "span_id": "b1c2d3e4f5g6h7i8", "parent_span_id": "", "name": "POST /order", "kind": 2, "status_code": 1, "status_message": "", "resources": { "deployment.environment": "production", "service.name": "order-service", "os.type": "linux", "host.name": "linux-000" }, "attributes": { "net.transport": "IP.TCP", "http.scheme": "http", "http.user_agent": "Integration Test", "http.request.method": "POST", "http.response.status_code": "200", "http.request.path": "/order" } }
+{ "timestamp": "2026-01-29T10:05:00.000000Z", "duration": "PT1.6S", "trace_id": "491f6d3d6b0a1f9e8a71b2c3d4e5f6b2", "span_id": "b2c3d4e5f6g7h8i9", "parent_span_id": "", "name": "POST /order", "kind": 2, "status_code": 1, "status_message": "", "resources": { "deployment.environment": "production", "service.name": "order-service", "os.type": "linux", "host.name": "linux-000" },"attributes": { "net.transport": "IP.TCP", "http.scheme": "http", "http.user_agent": "Integration Test", "http.request.method": "POST", "http.response.status_code": "200", "http.request.path": "/order" } }
+{ "timestamp": "2026-01-29T10:05:30.000000Z", "duration": "PT0.85S", "trace_id": "491f6d3d6b0a1f9e8a71b2c3d4e5f6b3", "span_id": "b3c4d5e6f7g8h9i0", "parent_span_id": "", "name": "POST /order", "kind": 2, "status_code": 1, "status_message": "", "resources": { "deployment.environment": "production", "service.name": "order-service", "os.type": "linux", "host.name": "linux-000" }, "attributes": { "net.transport": "IP.TCP", "http.scheme": "http", "http.user_agent": "Integration Test", "http.request.method": "POST", "http.response.status_code": "200", "http.request.path": "/order" } }
+{ "timestamp": "2026-01-29T10:06:00.000000Z", "duration": "PT1.7S", "trace_id": "491f6d3d6b0a1f9e8a71b2c3d4e5f6b4", "span_id": "b4c5d6e7f8g9h0i1", "parent_span_id": "", "name": "POST /order", "kind": 2, "status_code": 1, "status_message": "", "resources": { "deployment.environment": "production", "service.name": "order-service", "os.type": "linux", "host.name": "linux-000" }, "attributes": { "net.transport": "IP.TCP", "http.scheme": "http", "http.user_agent": "Integration Test", "http.request.method": "POST", "http.response.status_code": "200", "http.request.path": "/order" } }
+{ "timestamp": "2026-01-29T10:06:30.000000Z", "duration": "PT1.25S", "trace_id": "491f6d3d6b0a1f9e8a71b2c3d4e5f6b5", "span_id": "b5c6d7e8f9g0h1i2", "parent_span_id": "", "name": "POST /order", "kind": 2, "status_code": 1, "status_message": "", "resources": { "deployment.environment": "production", "service.name": "order-service", "os.type": "linux", "host.name": "linux-000" }, "attributes": { "net.transport": "IP.TCP", "http.scheme": "http", "http.user_agent": "Integration Test", "http.request.method": "POST", "http.response.status_code": "200", "http.request.path": "/order" } }
+{ "timestamp": "2026-01-29T10:07:00.000000Z", "duration": "PT0.95S", "trace_id": "491f6d3d6b0a1f9e8a71b2c3d4e5f6b6", "span_id": "b6c7d8e9f0g1h2i3", "parent_span_id": "", "name": "POST /order", "kind": 2, "status_code": 1, "status_message": "", "resources": { "deployment.environment": "production", "service.name": "order-service", "os.type": "linux", "host.name": "linux-000" }, "attributes": { "net.transport": "IP.TCP", "http.scheme": "http", "http.user_agent": "Integration Test", "http.request.method": "POST", "http.response.status_code": "200", "http.request.path": "/order" } }
+{ "timestamp": "2026-01-29T10:07:30.000000Z", "duration": "PT1.9S", "trace_id": "491f6d3d6b0a1f9e8a71b2c3d4e5f6b7", "span_id": "b7c8d9e0f1g2h3i4", "parent_span_id": "", "name": "POST /order", "kind": 2, "status_code": 1, "status_message": "", "resources": { "deployment.environment": "production", "service.name": "order-service", "os.type": "linux", "host.name": "linux-000" }, "attributes": { "net.transport": "IP.TCP", "http.scheme": "http", "http.user_agent": "Integration Test", "http.request.method": "POST", "http.response.status_code": "200", "http.request.path": "/order" } }
+{ "timestamp": "2026-01-29T10:08:00.000000Z", "duration": "PT1.35S", "trace_id": "491f6d3d6b0a1f9e8a71b2c3d4e5f6b8", "span_id": "b8c9d0e1f2g3h4i5", "parent_span_id": "", "name": "POST /order", "kind": 2, "status_code": 1, "status_message": "", "resources": { "deployment.environment": "production", "service.name": "order-service", "os.type": "linux", "host.name": "linux-000" }, "attributes": { "net.transport": "IP.TCP", "http.scheme": "http", "http.user_agent": "Integration Test", "http.request.method": "POST", "http.response.status_code": "200", "http.request.path": "/order" } }
+{ "timestamp": "2026-01-29T10:08:30.000000Z", "duration": "PT0.75S", "trace_id": "491f6d3d6b0a1f9e8a71b2c3d4e5f6b9", "span_id": "b9c0d1e2f3g4h5i6", "parent_span_id": "", "name": "POST /order", "kind": 2, "status_code": 1, "status_message": "", "resources": { "deployment.environment": "production", "service.name": "order-service", "os.type": "linux", "host.name": "linux-000" }, "attributes": { "net.transport": "IP.TCP", "http.scheme": "http", "http.user_agent": "Integration Test", "http.request.method": "POST", "http.response.status_code": "200", "http.request.path": "/order" } }
+{ "timestamp": "2026-01-29T10:09:00.000000Z", "duration": "PT1.55S", "trace_id": "491f6d3d6b0a1f9e8a71b2c3d4e5f6c1", "span_id": "c1d2e3f4g5h6i7j8", "parent_span_id": "", "name": "POST /order", "kind": 2, "status_code": 1, "status_message": "", "resources": { "deployment.environment": "production", "service.name": "order-service", "os.type": "linux", "host.name": "linux-000" }, "attributes": { "net.transport": "IP.TCP", "http.scheme": "http", "http.user_agent": "Integration Test", "http.request.method": "POST", "http.response.status_code": "200", "http.request.path": "/order" } }
+{ "timestamp": "2026-01-29T10:10:00.000000Z", "duration": "PT1.65S", "trace_id": "491f6d3d6b0a1f9e8a71b2c3d4e5f6c2", "span_id": "c2d3e4f5g6h7i8j9", "parent_span_id": "", "name": "POST /order", "kind": 2, "status_code": 1, "status_message": "", "resources": { "deployment.environment": "production", "service.name": "order-service", "os.type": "linux", "host.name": "linux-000" }, "attributes": { "net.transport": "IP.TCP", "http.scheme": "http", "http.user_agent": "Integration Test", "http.request.method": "POST", "http.response.status_code": "200", "http.request.path": "/order" } }

tests/integration/testdata/alerts/test_scenarios/threshold_above_average/rule.json

@@ -0,0 +1,68 @@
+{
+  "alert": "threshold_above_average",
+  "ruleType": "threshold_rule",
+  "alertType": "TRACES_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 1,
+          "matchType": "3",
+          "op": "1",
+          "channels": [
+            "test channel"
+          ],
+          "targetUnit": "s"
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "unit": "ns",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "traces",
+            "filter": {
+              "expression": "http.request.path = '/order'"
+            },
+            "aggregations": [
+              {
+                "expression": "p90(duration_nano)"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/threshold_above_in_total/alert_data.jsonl

@@ -0,0 +1,24 @@
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:01:00+00:00","value":1,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"server","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:01:00+00:00","value":1,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:02:00+00:00","value":2,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"server","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:02:00+00:00","value":2,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:03:00+00:00","value":3,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"server","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:03:00+00:00","value":3,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:04:00+00:00","value":4,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"server","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:04:00+00:00","value":4,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:05:00+00:00","value":305,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"server","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:05:00+00:00","value":305,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:06:00+00:00","value":306,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"server","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:06:00+00:00","value":306,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:07:00+00:00","value":307,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"server","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:07:00+00:00","value":307,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:08:00+00:00","value":308,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"server","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:08:00+00:00","value":308,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:09:00+00:00","value":309,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"server","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:09:00+00:00","value":309,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:10:00+00:00","value":310,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"server","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:10:00+00:00","value":310,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:11:00+00:00","value":311,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"server","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:11:00+00:00","value":311,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:12:00+00:00","value":312,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_above_in_total","labels":{"service":"server","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:12:00+00:00","value":312,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/threshold_above_in_total/rule.json

@@ -0,0 +1,74 @@
+{
+  "alert": "threshold_above_in_total",
+  "ruleType": "threshold_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 5,
+          "matchType": "4",
+          "op": "1",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "metrics",
+            "groupBy": [
+              {
+                "name": "service",
+                "fieldDataType": "",
+                "fieldContext": ""
+              }
+            ],
+            "aggregations": [
+              {
+                "metricName": "request_total_threshold_above_in_total",
+                "timeAggregation": "rate",
+                "spaceAggregation": "sum"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [
+      "service"
+    ],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/threshold_above_last/alert_data.jsonl

@@ -0,0 +1,12 @@
+{"metric_name":"disk_usage_threshold_above_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:01:00+00:00","value":5,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_threshold_above_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:02:00+00:00","value":10,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_threshold_above_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:03:00+00:00","value":15,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_threshold_above_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:04:00+00:00","value":20,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_threshold_above_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:05:00+00:00","value":31,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_threshold_above_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:06:00+00:00","value":46,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_threshold_above_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:07:00+00:00","value":58,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_threshold_above_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:08:00+00:00","value":71,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_threshold_above_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:09:00+00:00","value":76,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_threshold_above_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:10:00+00:00","value":81,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_threshold_above_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:11:00+00:00","value":86,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_threshold_above_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:12:00+00:00","value":91,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/threshold_above_last/rule.json

@@ -0,0 +1,65 @@
+{
+  "alert": "threshold_above_last",
+  "ruleType": "threshold_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 10,
+          "matchType": "5",
+          "op": "1",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "metrics",
+            "aggregations": [
+              {
+                "metricName": "disk_usage_threshold_above_last",
+                "timeAggregation": "latest",
+                "spaceAggregation": "max"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/threshold_below_all_the_time/alert_data.jsonl

@@ -0,0 +1,18 @@
+{ "timestamp": "2026-01-29T10:00:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "payment success", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:00:02.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "payment success", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:01:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "Database connection established", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:01:30.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "payment success", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:02:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "API request received", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:02:30.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "payment success", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:03:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "Request validation completed", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:03:30.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "payment success", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:04:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "Cache updated successfully", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:04:30.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "payment success", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:05:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "Rate limit check passed", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:05:30.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "payment success", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:06:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "Authentication token validated", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:06:30.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "payment success", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:07:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "Query executed successfully", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:08:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "Response sent to client", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:09:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "Metrics collected", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:10:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "Background job started", "severity_text": "INFO" }

tests/integration/testdata/alerts/test_scenarios/threshold_below_all_the_time/rule.json

@@ -0,0 +1,66 @@
+{
+  "alert": "threshold_below_all_the_time",
+  "ruleType": "threshold_rule",
+  "alertType": "LOGS_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 10,
+          "matchType": "2",
+          "op": "2",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "logs",
+            "filter": {
+              "expression": "body CONTAINS 'payment success'"
+            },
+            "aggregations": [
+              {
+                "expression": "count()"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/threshold_below_at_least_once/alert_data.jsonl

@@ -0,0 +1,20 @@
+{ "timestamp": "2026-01-29T10:00:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "User login successful", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:00:30.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "payment success", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:01:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "payment success", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:01:30.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "Database connection established", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:02:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "payment success", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:02:30.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "payment success", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:03:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "API request received", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:03:30.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "payment success", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:04:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "payment success", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:04:30.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "Cache updated successfully", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:05:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "payment success", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:05:30.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "Request validation completed", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:06:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "payment success", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:06:30.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "Authentication token validated", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:07:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "payment success", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:07:30.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "Query executed successfully", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:08:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "Response sent to client", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:08:30.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "Health check endpoint called", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:09:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "Metrics collected", "severity_text": "INFO" }
+{ "timestamp": "2026-01-29T10:10:00.000000Z", "resources": { "service.name": "payment-service" }, "attributes": { "code.file": "payment_handler.py" }, "body": "Background job started", "severity_text": "INFO" }

tests/integration/testdata/alerts/test_scenarios/threshold_below_at_least_once/rule.json

@@ -0,0 +1,66 @@
+{
+  "alert": "threshold_below_at_least_once",
+  "ruleType": "threshold_rule",
+  "alertType": "LOGS_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 10,
+          "matchType": "1",
+          "op": "2",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "logs",
+            "filter": {
+              "expression": "body CONTAINS 'payment success'"
+            },
+            "aggregations": [
+              {
+                "expression": "count()"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/threshold_below_average/alert_data.jsonl

@@ -0,0 +1,12 @@
+{"metric_name":"cpu_percent_threshold_below_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:01:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_below_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:02:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_below_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:03:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_below_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:04:00+00:00","value":5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_below_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:05:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_below_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:06:00+00:00","value":5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_below_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:07:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_below_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:08:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_below_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:09:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_below_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:10:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_below_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:11:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_below_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:12:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/threshold_below_average/rule.json

@@ -0,0 +1,65 @@
+{
+  "alert": "threshold_below_average",
+  "ruleType": "threshold_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 10,
+          "matchType": "3",
+          "op": "2",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "metrics",
+            "aggregations": [
+              {
+                "metricName": "cpu_percent_threshold_below_average",
+                "timeAggregation": "avg",
+                "spaceAggregation": "max"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/threshold_below_in_total/alert_data.jsonl

@@ -0,0 +1,12 @@
+{"metric_name":"bytes_per_second_threshold_below_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:01:00+00:00","value":1,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_below_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:02:00+00:00","value":2,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_below_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:03:00+00:00","value":3,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_below_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:04:00+00:00","value":4,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_below_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:05:00+00:00","value":300,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_below_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:06:00+00:00","value":301,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_below_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:07:00+00:00","value":302,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_below_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:08:00+00:00","value":303,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_below_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:09:00+00:00","value":304,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_below_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:10:00+00:00","value":305,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_below_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:11:00+00:00","value":306,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_below_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:12:00+00:00","value":307,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/threshold_below_in_total/rule.json

@@ -0,0 +1,65 @@
+{
+  "alert": "threshold_below_in_total",
+  "ruleType": "threshold_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 10,
+          "matchType": "4",
+          "op": "2",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "metrics",
+            "aggregations": [
+              {
+                "metricName": "bytes_per_second_threshold_below_in_total",
+                "timeAggregation": "rate",
+                "spaceAggregation": "sum"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/threshold_below_last/alert_data.jsonl

@@ -0,0 +1,12 @@
+{"metric_name":"disk_usage_mb_left_threshold_below_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:01:00+00:00","value":100,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_left_threshold_below_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:02:00+00:00","value":95,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_left_threshold_below_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:03:00+00:00","value":90,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_left_threshold_below_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:04:00+00:00","value":85,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_left_threshold_below_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:05:00+00:00","value":5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_left_threshold_below_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:06:00+00:00","value":3,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_left_threshold_below_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:07:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_left_threshold_below_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:08:00+00:00","value":78,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_left_threshold_below_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:09:00+00:00","value":72,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_left_threshold_below_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:10:00+00:00","value":80,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_left_threshold_below_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:11:00+00:00","value":76,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_left_threshold_below_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:12:00+00:00","value":82,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/threshold_below_last/rule.json

@@ -0,0 +1,65 @@
+{
+  "alert": "threshold_below_last",
+  "ruleType": "threshold_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 10,
+          "matchType": "5",
+          "op": "2",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "metrics",
+            "aggregations": [
+              {
+                "metricName": "disk_usage_mb_left_threshold_below_last",
+                "timeAggregation": "latest",
+                "spaceAggregation": "min"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/threshold_equal_to_all_the_time/alert_data.jsonl

@@ -0,0 +1,12 @@
+{"metric_name":"cpu_percent_threshold_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:01:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:02:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:03:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:04:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:05:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:06:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:07:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:08:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:09:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:10:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:11:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:12:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/threshold_equal_to_all_the_time/rule.json

@@ -0,0 +1,65 @@
+{
+  "alert": "threshold_equal_to_all_the_time",
+  "ruleType": "threshold_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 10,
+          "matchType": "2",
+          "op": "3",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "metrics",
+            "aggregations": [
+              {
+                "metricName": "cpu_percent_threshold_equal_to_all_the_time",
+                "timeAggregation": "avg",
+                "spaceAggregation": "max"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/threshold_equal_to_at_least_once/alert_data.jsonl

@@ -0,0 +1,12 @@
+{"metric_name":"cpu_percent_threshold_equal_to_at_least_once","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:01:00+00:00","value":5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_at_least_once","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:02:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_at_least_once","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:03:00+00:00","value":15,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_at_least_once","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:04:00+00:00","value":8,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_at_least_once","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:05:00+00:00","value":12,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_at_least_once","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:06:00+00:00","value":7,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_at_least_once","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:07:00+00:00","value":9,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_at_least_once","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:08:00+00:00","value":11,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_at_least_once","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:09:00+00:00","value":6,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_at_least_once","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:10:00+00:00","value":13,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_at_least_once","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:11:00+00:00","value":8,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_at_least_once","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:12:00+00:00","value":14,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/threshold_equal_to_at_least_once/rule.json

@@ -0,0 +1,65 @@
+{
+  "alert": "threshold_equal_to_at_least_once",
+  "ruleType": "threshold_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 10,
+          "matchType": "1",
+          "op": "3",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "metrics",
+            "aggregations": [
+              {
+                "metricName": "cpu_percent_threshold_equal_to_at_least_once",
+                "timeAggregation": "avg",
+                "spaceAggregation": "max"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/threshold_equal_to_average/alert_data.jsonl

@@ -0,0 +1,12 @@
+{"metric_name":"cpu_percent_threshold_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:01:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:02:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:03:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:04:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:05:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:06:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:07:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:08:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:09:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:10:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:11:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:12:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/threshold_equal_to_average/rule.json

@@ -0,0 +1,65 @@
+{
+  "alert": "threshold_equal_to_average",
+  "ruleType": "threshold_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 10,
+          "matchType": "3",
+          "op": "3",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "metrics",
+            "aggregations": [
+              {
+                "metricName": "cpu_percent_threshold_equal_to_average",
+                "timeAggregation": "avg",
+                "spaceAggregation": "max"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/threshold_equal_to_in_total/alert_data.jsonl

@@ -0,0 +1,12 @@
+{"metric_name":"bytes_per_second_threshold_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:01:00+00:00","value":0,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:02:00+00:00","value":60,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:03:00+00:00","value":120,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:04:00+00:00","value":180,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:05:00+00:00","value":600,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:06:00+00:00","value":600,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:07:00+00:00","value":720,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:08:00+00:00","value":780,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:09:00+00:00","value":840,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:10:00+00:00","value":900,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:11:00+00:00","value":960,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:12:00+00:00","value":1020,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/threshold_equal_to_in_total/rule.json

@@ -0,0 +1,65 @@
+{
+  "alert": "threshold_equal_to_in_total",
+  "ruleType": "threshold_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 10,
+          "matchType": "4",
+          "op": "3",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "metrics",
+            "aggregations": [
+              {
+                "metricName": "bytes_per_second_threshold_equal_to_in_total",
+                "timeAggregation": "rate",
+                "spaceAggregation": "sum"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/threshold_equal_to_last/alert_data.jsonl

@@ -0,0 +1,12 @@
+{"metric_name":"disk_usage_mb_threshold_equal_to_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:01:00+00:00","value":5,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_threshold_equal_to_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:02:00+00:00","value":10,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_threshold_equal_to_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:03:00+00:00","value":15,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_threshold_equal_to_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:04:00+00:00","value":20,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_threshold_equal_to_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:05:00+00:00","value":30,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_threshold_equal_to_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:06:00+00:00","value":40,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_threshold_equal_to_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:07:00+00:00","value":50,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_threshold_equal_to_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:08:00+00:00","value":55,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_threshold_equal_to_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:09:00+00:00","value":60,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_threshold_equal_to_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:10:00+00:00","value":65,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_threshold_equal_to_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:11:00+00:00","value":70,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_mb_threshold_equal_to_last","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:12:00+00:00","value":75,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/threshold_equal_to_last/rule.json

@@ -0,0 +1,65 @@
+{
+  "alert": "threshold_equal_to_last",
+  "ruleType": "threshold_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 10,
+          "matchType": "5",
+          "op": "3",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "metrics",
+            "aggregations": [
+              {
+                "metricName": "disk_usage_mb_threshold_equal_to_last",
+                "timeAggregation": "latest",
+                "spaceAggregation": "max"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/threshold_not_equal_to_all_the_time/alert_data.jsonl

@@ -0,0 +1,12 @@
+{"metric_name":"cpu_percent_threshold_not_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:01:00+00:00","value":2,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:02:00+00:00","value":5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:03:00+00:00","value":5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:04:00+00:00","value":5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:05:00+00:00","value":5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:06:00+00:00","value":5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:07:00+00:00","value":5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:08:00+00:00","value":5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:09:00+00:00","value":5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:10:00+00:00","value":5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:11:00+00:00","value":5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_all_the_time","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:12:00+00:00","value":5,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/threshold_not_equal_to_all_the_time/rule.json

@@ -0,0 +1,65 @@
+{
+  "alert": "threshold_not_equal_to_all_the_time",
+  "ruleType": "threshold_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 10,
+          "matchType": "2",
+          "op": "4",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "metrics",
+            "aggregations": [
+              {
+                "metricName": "cpu_percent_threshold_not_equal_to_all_the_time",
+                "timeAggregation": "avg",
+                "spaceAggregation": "max"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/threshold_not_equal_to_at_least_once/alert_data.jsonl

@@ -0,0 +1,12 @@
+{"metric_name":"request_total_threshold_not_equal_to_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:01:00+00:00","value":100,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_not_equal_to_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:02:00+00:00","value":200,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_not_equal_to_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:03:00+00:00","value":300,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_not_equal_to_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:04:00+00:00","value":400,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_not_equal_to_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:05:00+00:00","value":430,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_not_equal_to_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:06:00+00:00","value":450,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_not_equal_to_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:07:00+00:00","value":500,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_not_equal_to_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:08:00+00:00","value":600,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_not_equal_to_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:09:00+00:00","value":700,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_not_equal_to_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:10:00+00:00","value":800,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_not_equal_to_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:11:00+00:00","value":900,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"request_total_threshold_not_equal_to_at_least_once","labels":{"service":"api","endpoint":"/health","status_code":"200"},"timestamp":"2026-01-29T10:12:00+00:00","value":1000,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/threshold_not_equal_to_at_least_once/rule.json

@@ -0,0 +1,65 @@
+{
+  "alert": "threshold_not_equal_to_at_least_once",
+  "ruleType": "threshold_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 5,
+          "matchType": "1",
+          "op": "4",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "metrics",
+            "aggregations": [
+              {
+                "metricName": "request_total_threshold_not_equal_to_at_least_once",
+                "timeAggregation": "rate",
+                "spaceAggregation": "sum"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/threshold_not_equal_to_average/alert_data.jsonl

@@ -0,0 +1,12 @@
+{"metric_name":"cpu_percent_threshold_not_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:01:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:02:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:03:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:04:00+00:00","value":3,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:05:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:06:00+00:00","value":16,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:07:00+00:00","value":11,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:08:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:09:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:10:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:11:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"cpu_percent_threshold_not_equal_to_average","labels":{"host":"server-01","cpu":"cpu0"},"timestamp":"2026-01-29T10:12:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/threshold_not_equal_to_average/rule.json

@@ -0,0 +1,65 @@
+{
+  "alert": "threshold_not_equal_to_average",
+  "ruleType": "threshold_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 10,
+          "matchType": "3",
+          "op": "4",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "metrics",
+            "aggregations": [
+              {
+                "metricName": "cpu_percent_threshold_not_equal_to_average",
+                "timeAggregation": "avg",
+                "spaceAggregation": "max"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/threshold_not_equal_to_in_total/alert_data.jsonl

@@ -0,0 +1,12 @@
+{"metric_name":"bytes_per_second_threshold_not_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:01:00+00:00","value":1,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_not_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:02:00+00:00","value":2,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_not_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:03:00+00:00","value":3,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_not_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:04:00+00:00","value":4,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_not_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:05:00+00:00","value":605,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_not_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:06:00+00:00","value":606,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_not_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:07:00+00:00","value":607,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_not_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:08:00+00:00","value":608,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_not_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:09:00+00:00","value":609,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_not_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:10:00+00:00","value":610,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_not_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:11:00+00:00","value":611,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"bytes_per_second_threshold_not_equal_to_in_total","labels":{"interface":"eth0","protocol":"tcp"},"timestamp":"2026-01-29T10:12:00+00:00","value":612,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/threshold_not_equal_to_in_total/rule.json

@@ -0,0 +1,65 @@
+{
+  "alert": "threshold_not_equal_to_in_total",
+  "ruleType": "threshold_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 10,
+          "matchType": "4",
+          "op": "4",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "metrics",
+            "aggregations": [
+              {
+                "metricName": "bytes_per_second_threshold_not_equal_to_in_total",
+                "timeAggregation": "rate",
+                "spaceAggregation": "sum"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/threshold_not_equal_to_last/alert_data.jsonl

@@ -0,0 +1,12 @@
+{"metric_name":"seats_left_threshold_not_equal_to_last","labels":{"venue":"conference_hall","section":"main"},"timestamp":"2026-01-29T10:01:00+00:00","value":9,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"seats_left_threshold_not_equal_to_last","labels":{"venue":"conference_hall","section":"main"},"timestamp":"2026-01-29T10:02:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"seats_left_threshold_not_equal_to_last","labels":{"venue":"conference_hall","section":"main"},"timestamp":"2026-01-29T10:03:00+00:00","value":11,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"seats_left_threshold_not_equal_to_last","labels":{"venue":"conference_hall","section":"main"},"timestamp":"2026-01-29T10:04:00+00:00","value":9,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"seats_left_threshold_not_equal_to_last","labels":{"venue":"conference_hall","section":"main"},"timestamp":"2026-01-29T10:05:00+00:00","value":11,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"seats_left_threshold_not_equal_to_last","labels":{"venue":"conference_hall","section":"main"},"timestamp":"2026-01-29T10:06:00+00:00","value":9,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"seats_left_threshold_not_equal_to_last","labels":{"venue":"conference_hall","section":"main"},"timestamp":"2026-01-29T10:07:00+00:00","value":11,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"seats_left_threshold_not_equal_to_last","labels":{"venue":"conference_hall","section":"main"},"timestamp":"2026-01-29T10:08:00+00:00","value":10,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"seats_left_threshold_not_equal_to_last","labels":{"venue":"conference_hall","section":"main"},"timestamp":"2026-01-29T10:09:00+00:00","value":9,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"seats_left_threshold_not_equal_to_last","labels":{"venue":"conference_hall","section":"main"},"timestamp":"2026-01-29T10:10:00+00:00","value":11,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"seats_left_threshold_not_equal_to_last","labels":{"venue":"conference_hall","section":"main"},"timestamp":"2026-01-29T10:11:00+00:00","value":9,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"seats_left_threshold_not_equal_to_last","labels":{"venue":"conference_hall","section":"main"},"timestamp":"2026-01-29T10:12:00+00:00","value":11,"temporality":"Unspecified","type_":"Gauge","is_monotonic":false,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/threshold_not_equal_to_last/rule.json

@@ -0,0 +1,65 @@
+{
+  "alert": "threshold_not_equal_to_last",
+  "ruleType": "threshold_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 10,
+          "matchType": "5",
+          "op": "4",
+          "channels": [
+            "test channel"
+          ]
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "metrics",
+            "aggregations": [
+              {
+                "metricName": "seats_left_threshold_not_equal_to_last",
+                "timeAggregation": "latest",
+                "spaceAggregation": "min"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/unit_conversion_bytes_to_mb/alert_data.jsonl

@@ -0,0 +1,12 @@
+{"metric_name":"disk_usage_unit_conversion_bytes_to_mb","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:01:00+00:00","value":524288,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_unit_conversion_bytes_to_mb","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:02:00+00:00","value":1048576,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_unit_conversion_bytes_to_mb","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:03:00+00:00","value":1572864,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_unit_conversion_bytes_to_mb","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:04:00+00:00","value":2097152,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_unit_conversion_bytes_to_mb","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:05:00+00:00","value":3770016,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_unit_conversion_bytes_to_mb","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:06:00+00:00","value":5642880,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_unit_conversion_bytes_to_mb","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:07:00+00:00","value":10515744,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_unit_conversion_bytes_to_mb","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:08:00+00:00","value":11038632,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_unit_conversion_bytes_to_mb","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:09:00+00:00","value":11561520,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_unit_conversion_bytes_to_mb","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:10:00+00:00","value":12084408,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_unit_conversion_bytes_to_mb","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:11:00+00:00","value":12607296,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"disk_usage_unit_conversion_bytes_to_mb","labels":{"device":"/dev/sda1","mountpoint":"/"},"timestamp":"2026-01-29T10:12:00+00:00","value":13130184,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/unit_conversion_bytes_to_mb/rule.json

@@ -0,0 +1,67 @@
+{
+  "alert": "unit_conversion_bytes_to_mb",
+  "ruleType": "threshold_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 1.5,
+          "matchType": "1",
+          "op": "1",
+          "channels": [
+            "test channel"
+          ],
+          "targetUnit": "MBy"
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "unit": "By",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "metrics",
+            "aggregations": [
+              {
+                "metricName": "disk_usage_unit_conversion_bytes_to_mb",
+                "timeAggregation": "latest",
+                "spaceAggregation": "max"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}

tests/integration/testdata/alerts/test_scenarios/unit_conversion_ms_to_second/alert_data.jsonl

@@ -0,0 +1,12 @@
+{"metric_name":"duration_ms_unit_conversion_ms_to_second","labels":{"service":"api","endpoint":"/health","method":"GET","status_code":"200"},"timestamp":"2026-01-29T10:01:00+00:00","value":500,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"duration_ms_unit_conversion_ms_to_second","labels":{"service":"api","endpoint":"/health","method":"GET","status_code":"200"},"timestamp":"2026-01-29T10:02:00+00:00","value":1000,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"duration_ms_unit_conversion_ms_to_second","labels":{"service":"api","endpoint":"/health","method":"GET","status_code":"200"},"timestamp":"2026-01-29T10:03:00+00:00","value":1500,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"duration_ms_unit_conversion_ms_to_second","labels":{"service":"api","endpoint":"/health","method":"GET","status_code":"200"},"timestamp":"2026-01-29T10:04:00+00:00","value":2000,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"duration_ms_unit_conversion_ms_to_second","labels":{"service":"api","endpoint":"/health","method":"GET","status_code":"200"},"timestamp":"2026-01-29T10:05:00+00:00","value":182100,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"duration_ms_unit_conversion_ms_to_second","labels":{"service":"api","endpoint":"/health","method":"GET","status_code":"200"},"timestamp":"2026-01-29T10:06:00+00:00","value":182200,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"duration_ms_unit_conversion_ms_to_second","labels":{"service":"api","endpoint":"/health","method":"GET","status_code":"200"},"timestamp":"2026-01-29T10:07:00+00:00","value":182300,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"duration_ms_unit_conversion_ms_to_second","labels":{"service":"api","endpoint":"/health","method":"GET","status_code":"200"},"timestamp":"2026-01-29T10:08:00+00:00","value":182400,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"duration_ms_unit_conversion_ms_to_second","labels":{"service":"api","endpoint":"/health","method":"GET","status_code":"200"},"timestamp":"2026-01-29T10:09:00+00:00","value":182500,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"duration_ms_unit_conversion_ms_to_second","labels":{"service":"api","endpoint":"/health","method":"GET","status_code":"200"},"timestamp":"2026-01-29T10:10:00+00:00","value":182600,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"duration_ms_unit_conversion_ms_to_second","labels":{"service":"api","endpoint":"/health","method":"GET","status_code":"200"},"timestamp":"2026-01-29T10:11:00+00:00","value":182700,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}
+{"metric_name":"duration_ms_unit_conversion_ms_to_second","labels":{"service":"api","endpoint":"/health","method":"GET","status_code":"200"},"timestamp":"2026-01-29T10:12:00+00:00","value":182800,"temporality":"Cumulative","type_":"Sum","is_monotonic":true,"flags":0,"description":"","unit":"","env":"default","resource_attrs":{},"scope_attrs":{}}

tests/integration/testdata/alerts/test_scenarios/unit_conversion_ms_to_second/rule.json

@@ -0,0 +1,67 @@
+{
+  "alert": "unit_conversion_ms_to_second",
+  "ruleType": "threshold_rule",
+  "alertType": "METRIC_BASED_ALERT",
+  "condition": {
+    "thresholds": {
+      "kind": "basic",
+      "spec": [
+        {
+          "name": "critical",
+          "target": 3,
+          "matchType": "1",
+          "op": "1",
+          "channels": [
+            "test channel"
+          ],
+          "targetUnit": "s"
+        }
+      ]
+    },
+    "compositeQuery": {
+      "queryType": "builder",
+      "panelType": "graph",
+      "unit": "ms",
+      "queries": [
+        {
+          "type": "builder_query",
+          "spec": {
+            "name": "A",
+            "signal": "metrics",
+            "aggregations": [
+              {
+                "metricName": "duration_ms_unit_conversion_ms_to_second",
+                "timeAggregation": "rate",
+                "spaceAggregation": "sum"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    "selectedQueryName": "A"
+  },
+  "evaluation": {
+    "kind": "rolling",
+    "spec": {
+      "evalWindow": "5m0s",
+      "frequency": "15s"
+    }
+  },
+  "labels": {},
+  "annotations": {
+    "description": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})",
+    "summary": "This alert is fired when the defined metric (current value: {{$value}}) crosses the threshold ({{$threshold}})"
+  },
+  "notificationSettings": {
+    "groupBy": [],
+    "usePolicy": false,
+    "renotify": {
+      "enabled": false,
+      "interval": "30m",
+      "alertStates": []
+    }
+  },
+  "version": "v5",
+  "schemaVersion": "v2alpha1"
+}