Which alerts should page you, and which ones are just noise? Draw an incident across a day of traffic, and watch a fixed threshold, a single burn-rate alert, and multi-window burn-rate alerts decide whether to page. The demo needs JavaScript.
An error rate says how bad this minute is. A burn rate says how fast the month is going: 14.4x for an hour spends 2% of a 30-day budget, 6x for six hours spends 5%. A tall, short spike can matter less than a flat line you would never notice.
An hour-long window keeps paging for most of an hour after the fix, because the bad minutes are still inside it. Requiring a window a twelfth as long to agree as well clears the page once that short window is clean: five minutes for the fast tier, half an hour for the slow one.
The fast tier catches outages within minutes. The slow tier catches leaks that never look alarming on any one chart. Lowering a fixed threshold far enough to catch the leak would page for every blip.
All demos