This monitor reports a 100% error rate on a service that failed ONCE in four requests. The logs are prose strings, and the 'query' is a substring match — which happily matches the words "no error" in every success line. Fix the logging to structured dicts with an error field (None on success) and query the FIELD. The true rate is 1/4 — which still alerts, for the right reason.
The break is on lines 2, 8 — but read the whole snippet first.