[
  {
    "condition": "count(type=anomaly)>3",
    "action": "alert"
  }
]