docs: add alert rule configuration example

docs/使用手册/告警.md

@@ -72,6 +72,81 @@ flowchart LR
 
 ---
 
+## 配置示例
+
+下面以 `order-service` 为例，配置“最近 5 分钟平均错误率超过 5%”的严重告警。
+
+### 创建规则
+
+进入 **配置管理 → 告警配置 → 新建规则**，填写以下内容：
+
+| 配置项 | 示例值 | 说明 |
+|------|------|------|
+| 规则名称 | `order-service 错误率过高` | 用于在规则列表和事件记录中识别规则 |
+| 状态 | 启用 | 只有启用的规则才会参与评估 |
+| 指标 | `service.error.pct` | 服务入口错误率，单位为百分比 |
+| 统计方式 | 平均值 | 对统计窗口内的错误率取平均值 |
+| 评估周期 | 5 分钟 | 系统保存为 `period: 300` 秒，并读取最近 5 分钟数据 |
+| 比较条件 | 大于 `>` | 指标值严格大于阈值时触发 |
+| 严重阈值 | `5%` | 错误率超过 5% 时触发严重告警 |
+| 监控范围 | `service = order-service` | 只监控指定服务 |
+
+该配置对应的 JSON 如下。实际使用时推荐通过页面填写，页面会自动生成并保存相应的规则数据：
+
+```json
+{
+  "classification": "singleMetric",
+  "ruleName": "order-service 错误率过高",
+  "enabled": true,
+  "query": {
+    "1": {
+      "way": "threshold",
+      "period": 300,
+      "unit": "%",
+      "view_unit": "%",
+      "_scale": 1,
+      "time_aggregator": "avg",
+      "comparison": ">",
+      "thresholds": {
+        "critical": 5,
+        "warning": null
+      },
+      "A": {
+        "metric": "service.error.pct",
+        "aggs": "avg",
+        "by": ["service"],
+        "from": [
+          {
+            "connector": "AND",
+            "left": "service",
+            "operator": "=",
+            "right": "order-service"
+          }
+        ]
+      }
+    }
+  }
+}
+```
+
+其中：
+
+- `period: 300` 表示 300 秒，也就是 5 分钟；当前实现按这个时间窗口计算指标。
+- `service.error.pct` 返回百分比值，因此阈值应填写 `5`，而不是 `0.05`。
+- `by: ["service"]` 按服务分组；如果要监控所有服务，可以删除 `from` 中的服务过滤条件。
+- 当前示例表示“最近 5 分钟窗口的平均错误率大于 5%”，不表示连续 5 个采样点都必须超过阈值。
+
+### 触发后的结果
+
+系统每分钟评估一次规则。满足条件后：
+
+- **告警中心 → 告警列表** 会出现对应告警；
+- 事件记录会包含规则名称、服务、级别、触发状态和告警描述；
+- 告警详情可以查看异常指标趋势，并继续关联 Trace、日志和 AI 分析；
+- 指标恢复到阈值以内后，告警会自动标记为已解决。
+
+---
+
 ## 与 AI 协同
 
 告警详情页或 AI 平台可直接问：

docs/使用手册/告警_en.md

@@ -70,6 +70,81 @@ Alerts auto-resolve when metrics recover.
 
 ---
 
+## Configuration Example
+
+The following example configures a critical alert when the average error rate of `order-service` exceeds 5% over the most recent 5-minute window.
+
+### Create the rule
+
+Go to **Configuration → Alert Config → New Rule** and enter the following values:
+
+| Field | Example | Description |
+|-------|---------|-------------|
+| Rule name | `order-service error rate too high` | Identifies the rule in the rule list and event records |
+| Status | Enabled | Only enabled rules are evaluated |
+| Metric | `service.error.pct` | Service entry error rate, expressed as a percentage |
+| Aggregation | Average | Averages the error rate over the evaluation window |
+| Evaluation window | 5 minutes | Stored as `period: 300` seconds and evaluated against the latest 5 minutes |
+| Comparison | Greater than `>` | Triggers when the metric is strictly above the threshold |
+| Critical threshold | `5%` | Fires a critical alert when the error rate exceeds 5% |
+| Scope | `service = order-service` | Limits the rule to the selected service |
+
+The equivalent JSON is shown below. In normal use, fill in the form and let the page generate and save this rule data:
+
+```json
+{
+  "classification": "singleMetric",
+  "ruleName": "order-service error rate too high",
+  "enabled": true,
+  "query": {
+    "1": {
+      "way": "threshold",
+      "period": 300,
+      "unit": "%",
+      "view_unit": "%",
+      "_scale": 1,
+      "time_aggregator": "avg",
+      "comparison": ">",
+      "thresholds": {
+        "critical": 5,
+        "warning": null
+      },
+      "A": {
+        "metric": "service.error.pct",
+        "aggs": "avg",
+        "by": ["service"],
+        "from": [
+          {
+            "connector": "AND",
+            "left": "service",
+            "operator": "=",
+            "right": "order-service"
+          }
+        ]
+      }
+    }
+  }
+}
+```
+
+Notes:
+
+- `period: 300` means 300 seconds, or 5 minutes. The current implementation uses this as the metric lookback window.
+- `service.error.pct` returns a percentage, so enter `5` as the threshold rather than `0.05`.
+- `by: ["service"]` groups results by service. To monitor every service, remove the service filter from `from`.
+- This example means “the average error rate in the most recent 5-minute window is above 5%”; it does not require all five individual samples to exceed the threshold.
+
+### What happens when it fires
+
+The system evaluates the rule every minute. When the condition is met:
+
+- The alert appears in **Alert Center → Alert List**;
+- The event record includes the rule name, service, severity, trigger status, and alert description;
+- Alert details show the abnormal metric trend and can be correlated with traces, logs, and AI analysis;
+- Once the metric returns below the threshold, the alert is automatically marked as resolved.
+
+---
+
 ## Working with AI
 
 From alert details or AI Platform: