> Login failure is like the most important error you'll track. A login failure isn't necessarily actionable but a spike of thousands of them for sure is.

Sounds like you agree with me. Re-read my comment. Errors are actionable individually. Warnings are actionable in aggregate.

You don't have to treat logs and metrics as separate, you can have rules on log counts without emitting a metric.