I have events coming in that has a field called status_id. This field contains the values OK or ERROR. If I look at the last five minutes it's ok to have a ratio of 20% Errors and 80% events with status_id="OK".
How can I be alerted if the ratio changes to 50% Errors and 50% OK in next 5 minutes?
The total number of events during a 5 minutes period, can be between 20 and 200 depending on the time of the day.