example loki recording rule and alert configmap

loki-additional-rules.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: loki-additional-rules
  annotations:
    argocd.argoproj.io/compare-options: IgnoreExtraneous
  labels:
    loki_rule: 'true'
data:
  additional-loki-rules.yaml: |
    groups:
      - name: additional_loki_rules
        interval: 1m
        rules:
          - record: job:loki:kex:application:sum_rate
            expr: sum(rate({app="kubernetes-event-exporter"} | json | kind="Application" [5m])) by (name)
            labels:
              cluster: loki
      - name: additional_loki_alerts
        rules:
          - alert: TooManyEventsInTheApplication
            expr: |
              sum(rate({app="kubernetes-event-exporter"} | json | kind="Application" [5m])) by (name) > 0.05
            for: 0s
            labels:
                severity: page
            annotations:
                summary: High request latency

If you define to populate the rules using loki.rules of the HELM chart

loki:
  enable: true
  serviceAccount:
    annotations:
      eks.amazonaws.com/role-arn: arn:aws:iam::11111:role/project-prod-eks-loki-role
  rules: []

then your syntax would be:

loki:
  enable: true
  serviceAccount:
    annotations:
      eks.amazonaws.com/role-arn: arn:aws:iam::11111:role/project-prod-eks-loki-role

  rules:
    - name: additional_loki_rules
      interval: 1m
      rules:
        - record: job:loki:kex:application:sum_rate
          expr: sum(rate({app="kubernetes-event-exporter"} | json | kind="Application" [5m])) by (name)
          labels:
            cluster: loki
    - name: additional_loki_alerts
      rules:
        - alert: TooManyEventsInTheApplication
          expr: |
            sum(rate({app="kubernetes-event-exporter"} | json | kind="Application" [5m])) by (name) > 0.05
          for: 0s
          labels:
              severity: page
          annotations:
              summary: High request latency