- alert: CostPerRequestAnomaly
  expr: |
    (
      increase(cloud_spend_dollars_total{service="payment-processor"}[30m])
      /
      increase(http_requests_total{service="payment-processor"}[30m])
    ) > 0.02
  for: 15m
  labels:
    severity: warning
  annotations:
    summary: "Payment processor cost/request exceeding $0.02 threshold"
    runbook: "https://wiki.internal/runbooks/cost-anomaly"

bashset -euo pipefail

cat > /tmp/cost_data.csv <<'CSVEOF'
timestamp,requests,cost
08:00,1000,12.50
08:05,1100,13.00
08:10,1050,12.80
08:15,1200,13.50
08:20,1150,13.20
08:25,1000,12.50
08:30,1300,35.00
08:35,1250,33.00
08:40,1350,36.50
08:45,1400,38.00
08:50,1200,32.00
08:55,1100,30.00
CSVEOF

BASELINE=0.012  THRESHOLD=$(awk "BEGIN {print $BASELINE * 2}")

echo "=== cost-per-request 监控演示 ==="
echo "基线: \$${BASELINE}/request，告警阈值: \$${THRESHOLD}/request（基线 × 2）"
echo ""

tail -n +2 /tmp/cost_data.csv | while IFS=, read -r ts req cost; do
  cpr=$(awk "BEGIN {printf \"%.4f\", $cost / $req}")
  if awk -v cpr="$cpr" -v thresh="$THRESHOLD" 'BEGIN {exit !(cpr > thresh)}'; then
    printf "  %s  req=%s  cost=\$%-6s  cpr=\$%s  ← 超过阈值！\n" "$ts" "$req" "$cost" "$cpr"
  else
    printf "  %s  req=%s  cost=\$%-6s  cpr=\$%s\n" "$ts" "$req" "$cost" "$cpr"
  fi
done

echo ""
echo "08:30 开始 cpr 翻倍。排查方向："
echo "  1. 新部署是否引入了 N+1 查询"
echo "  2. 索引被误删导致全表扫描"
echo "  3. Serverless 函数是否有 retry storm"
echo "  4. 是否有人在跨 region 拉数据"