{unit="postgresql.service"}
        |~ "ALTER DATABASE \\w+ REFRESH COLLATION VERSION"
        | regexp "DATABASE (?<database>[a-zA-Z0-9]+) REFRESH" [5m]

      {unit="postgresql.service"}
        |~ "ALTER DATABASE \\w+ REFRESH COLLATION VERSION"
        | regexp "DATABASE (?<database>[a-zA-Z0-9]+) REFRESH"

[93980] WARNING:  database "template1" has a collation version mismatch
[93980] DETAIL:  The database was created using collation version 2.39, but the operating system provides version 2.40.
[93980] HINT:  Rebuild all objects in this database that use the default collation and run ALTER DATABASE template1 REFRESH COLLATION VERSION, or build PostgreSQL with the right library version.

  rulerConfig = {
    groups = [ {
      name = "postgresql";
      rules = [ {
        alert = "PostgresqlCollationMismatch";
        expr = ''
          {unit="postgresql.service"}
            |~ 'WARNING:  database "[^"]+" has a collation version mismatch'
            | regexp 'database "(?<database>[^"]+)"'
        '';
        labels.severity = "warning";
        annotations.summary = "PostgreSQL database {{ $labels.database }} on {{ $labels.machine }}i reports database collation mismatch";
      } ];
    } ];
  };

  rulerConfig = {
    groups = [ {
      name = "postgresql";
      rules = [ {
        alert = "PostgresqlCollationMismatch";
        expr = ''
          {unit="postgresql.service"}
            |~ 'WARNING:  database "[^"]+" has a collation version mismatch'
            | regexp 'database "(?<database>[^"]+)"'
        '';
        labels.severity = "warning";
        annotations.summary = "PostgreSQL database {{ $labels.database }} on {{ $labels.machine }}i reports database collation mismatch";
      } ];
    } ];
  };

  rulerConfig = {
    groups = [ {
      name = "postgresql";
      rules = [ {
        alert = "PostgresqlCollationMismatch";
        expr = ''
          {unit="postgresql.service"}
            |~ "WARNING:  database \"[^\"]+\" has a collation version mismatch"
            | regexp "database \"(?<database>[^\"]+)\""
        '';
        labels.severity = "warning";
        annotations.summary = "PostgreSQL database {{ $labels.database }} on {{ $labels.machine }}i reports database collation mismatch";
      } ];
    } ];
  };

# lokitool rules lint ruler.yml 
ERRO[0000] unable parse rules file                       error="could not parse expression for alert 'PostgresqlCollationMismatch' in group 'postgresql': parse error at line 1, col 19: syntax error: unexpected IDENTIFIER" file=ruler.yml
lokitool: error: prepare operation unsuccessful, unable to parse rules files: file read error, try --help

{
  "groups": [
    {
      "name": "postgresql",
      "rules": [
        {
          "alert": "PostgresqlCollationMismatch",
          "annotations": {
            "summary": "PostgreSQL database on {{ $labels.machine }} reports database collations mismatches"
          },
          "expr": "sum by (machine) (counter_over_time({unit=\"postgresql.service\"} |~ \"REFRESH COLLATION VERSION\" [5m])) > 0\n",
          "for": "1m",
          "labels": {
            "severity": "warning"
          }
        }
      ]
    }
  ]
}

ERRO[0000] unable parse rules file                       error="could not parse expression for alert 'PostgresqlCollationMismatch' in group 'postgresql': parse error at line 1, col 19: syntax error: unexpected IDENTIFIER" file=/tmp/rules.yml

groups:
- name: postgresql
  rules:
  - alert: PostgresqlCollationMismatch
    annotations:
      summary: PostgreSQL database on {{ $labels.machine }} reports database collations
        mismatches
    expr: "sum by (machine) (counter_over_time({unit=\"postgresql.service\"} |~ \"\
      REFRESH COLLATION VERSION\" [5m])) > 0\n"
    for: 1m
    labels:
      severity: warning