Need a tick scripts for request status alert

My data contains with addr, uuid(addr and uuid are tags), status(which is field)
example
addr=1.1.1.1,uuid=1 status=502
addr=1.1.1.2,uuid=2 status=502
addr=1.1.1.3,uuid=3 status=200
...

I want to count 502 request times every 5s, and call alert if the count number is larger than 2
But need to alert message with all original tags and fields in request points, not only the count number
If the script is written in this way:
```
var data = stream
|from()
.measurement('log')
|where(lambda: "status" == 502)
|window()
.period(5s)
.every(5s)
|count('status')

var alert = data
|alert()
.message('...')
.warn(lambda: "count" > 2)
...
```
Only count number can be preserved in 'data'. Can any way to alert all tags and fields and count number?

Start with the TICKscript stream/window/count/alert chain shown in the issue; no file or test is named. Determine whether the alert can retain the original tags and fields alongside the count, with completion shown by triggering when the count exceeds 2 and exposing those values in the alert message.

Written by the indexing model from the issue text.