detect

type Alert struct {
	Query string
	Count int
}

type Detector struct {
	// contains filtered or unexported fields
}

type Result struct {
	// Matched is true when the query count is at or above the threshold
	// within the time window. Use this to mark every event in the pattern.
	Matched bool
	// Alert is non-nil only when the threshold is first crossed (respecting
	// cooldown). Use this to trigger a one-time notification.
	Alert *Alert
}