Alert based on cluster logs

apiVersion: operator.victoriametrics.com/v1beta1
kind: VMRule
metadata:
  labels:
    cluster: <your parameter value>
    role: user
    vmalert-type: vlogs
  name: <your parameter value>
  namespace: <your parameter value>
spec:
  groups:
    - headers:
        - <your parameter value>
      interval: 5m
      name: <your parameter value>
      type: vlogs
      rules:
        - alert: <your parameter value>
          annotations:
            description: 'SSC {{ index $labels "objectRef.name" }} was updated by {{ index $labels "user.username" }} in the last {{$for}}'
          expr: objectRef.resource:"shturvalserviceconfigs" verb:~"patch|update" | stats by(objectRef.name, objectRef.resource, user.username) count() as updateSSC | filter updateSSC:>1
          labels:
            source: vlogs 

apiVersion: operator.victoriametrics.com/v1beta1
kind: VMAlert
metadata:
  annotations:
  labels:
    cluster: <your parameter value> 
  name: vlogs
  namespace: <your parameter value> 
spec:
  datasource:
    url: <your parameter value>
  evaluationInterval: 30s
  externalLabels:
    cluster: <your parameter value>
  extraArgs:
    rule.defaultRuleType: vlogs
  image: {}
  notifiers:
    - url: http://vmalertmanager-shturval-metrics-collector.victoria-metrics:9093
  remoteRead:
    url: <your parameter value>
  remoteWrite:
    url: <your parameter value>
  resources:
    limits:
      cpu: <your parameter value>
      memory: <your parameter value>
    requests:
      cpu: <your parameter value>
      memory: <your parameter value>
  ruleSelector:
    matchLabels:
      vmalert-type: vlogs
      cluster: <your parameter value>clustername
  ruleNamespaceSelector: {}
  selectAllByDefault: false