{
  "sql": "SELECT\n  RayID AS ray_id,\n  EdgeResponseStatus AS status,\n  '[REDACTED]' AS client_ip_redacted,\n  'cloudflare' AS provider\nFROM http_requests\nWHERE EdgeResponseStatus >= 400\n",
  "input": {
    "RayID": "0000000000000003",
    "ClientIP": "198.51.100.17",
    "EdgeResponseStatus": 200,
    "ClientRequestURI": "/healthz",
    "ClientRequestUserAgent": "SyntheticProbe/1.0"
  }
}