Every threshold needs a duration

An alert on an instantaneous value fires on the spike that a deploy, a cron job or a single slow request produces, so the first thing anyone does is raise the threshold — which makes it fire late instead of often.

# fires on a single sample; will be ignored within a week
- alert: HighErrorRate
  expr: error_rate > 0.02

# fires on a condition that persisted
- alert: HighErrorRate
  expr: error_rate > 0.02
  for: 5m

The duration is the difference between “something happened” and “something is happening”, and it is the parameter that decides whether the alert is trusted. Choose it from how long the condition can persist before a user notices, not from how long it takes to be sure. The same applies in reverse: an alert that resolves instantly on one good sample flaps, so recovery wants a duration too.