(streams
    (where (and (service "HTTP") (state "500"))
         (with :metric 1
             (rate 10
                 (with {:service "HTTP 500 error/10s"}
                     (splitp < metric
                         10 (with :state "critical")
                          5 (with :state "warning")
                            (with :state "ok")
                     )
                     (notify "me@example.com")
                 )
             )
         )
    )
)