groups:
- name: auth_failure_sum_by_ip
interval: 5s
rules:
- record: job:auth_failure:sum_by_ip
expr: sum(auth_failure_counter) by (ip)