SELECT id, ts,
       LEAD(ts) OVER (ORDER BY ts) AS next_ts
FROM events;

SELECT user_id, COUNT(*) AS errors
FROM logs
WHERE level = 'ERROR'
  AND ts >= NOW() - INTERVAL '3 DAY'
GROUP BY user_id
HAVING COUNT(*) > (
  SELECT AVG(cnt)
  FROM (
    SELECT user_id, COUNT(*) AS cnt
    FROM logs
    WHERE level = 'ERROR'
    GROUP BY user_id
  ) t
);

sum by (service) (rate({level="error"}[5m]))

{service="auth"} |= "timeout" | json | line_format "{{.user_id}}"

trace_id:"*" AND span_status:"error"

ERROR: Connection refused to http://billing:8080

ElasticsearchError: index read-only / allow delete

[GATEWAY] → 2025-10-26 12:10:05 → Request /api/payments  
[AUTH] → 2025-10-26 12:10:05 → Token verified  
[BILLING] → 2025-10-26 12:10:06 → ERROR: Connection refused  
[EMAIL] → 2025-10-26 12:10:07 → Skipped notification (billing failed)