fix process query

host/process/README.md

@@ -52,8 +52,8 @@ No modules.
 | <a name="input_process_alert_enabled"></a> [process\_alert\_enabled](#input\_process\_alert\_enabled) | Flag to enable Process Check monitor | `string` | `"true"` | no |
 | <a name="input_process_alert_operator"></a> [process\_alert\_operator](#input\_process\_alert\_operator) | Operator for Process Alert Query [available values: `<, >, <=, >=, =`] | `string` | `"<"` | no |
 | <a name="input_process_alert_process_name"></a> [process\_alert\_process\_name](#input\_process\_alert\_process\_name) | Name of Process for Process Alert | `string` | `""` | no |
-| <a name="input_process_alert_threshold_critical"></a> [process\_alert\_threshold\_critical](#input\_process\_alert\_threshold\_critical) | Process Alert critical threshold | `number` | `5` | no |
-| <a name="input_process_alert_threshold_warning"></a> [process\_alert\_threshold\_warning](#input\_process\_alert\_threshold\_warning) | Process Alert warning threshold | `number` | `2` | no |
+| <a name="input_process_alert_threshold_critical"></a> [process\_alert\_threshold\_critical](#input\_process\_alert\_threshold\_critical) | Process Alert critical threshold | `number` | `1` | no |
+| <a name="input_process_alert_threshold_warning"></a> [process\_alert\_threshold\_warning](#input\_process\_alert\_threshold\_warning) | Process Alert warning threshold | `number` | `null` | no |
 | <a name="input_process_alert_timeframe"></a> [process\_alert\_timeframe](#input\_process\_alert\_timeframe) | Monitor timeframe for Process Alert [available values: `#m` (1, 5, 10, 15, or 30), `#h` (1, 2, or 4), or `1d`] | `string` | `"5m"` | no |
 | <a name="input_renotify_interval"></a> [renotify\_interval](#input\_renotify\_interval) | Interval in minutes to re-send notifications about an alert | `number` | `0` | no |
 | <a name="input_runbook_link"></a> [runbook\_link](#input\_runbook\_link) | Runbook link to include in message | `string` | `null` | no |

host/process/main.tf

@@ -26,7 +26,7 @@ resource "datadog_monitor" "process_alert" {
   require_full_window = true
 
   query = <<EOQ
-    processes("${var.process_alert_process_name}")${local.service_filter}.by("host").last(${var.process_alert_timeframe}})
+    processes("${var.process_alert_process_name}")${local.service_filter}.by("host").rollup("count").last(${var.process_alert_timeframe}})
       ${var.process_alert_operator} ${var.process_alert_threshold_critical}
   EOQ
 

host/process/variables.tf

@@ -37,13 +37,13 @@ variable "process_alert_timeframe" {
 variable "process_alert_threshold_warning" {
   description = "Process Alert warning threshold"
   type        = number
-  default     = 2
+  default     = null
 }
 
 variable "process_alert_threshold_critical" {
   description = "Process Alert critical threshold"
   type        = number
-  default     = 5
+  default     = 1
 }
 
 variable "process_alert_operator" {