I like to think of “warning” as something to alert on statistically, e.g. incorrect password attempt rate jumps from 0.4% of login attempts to 99%.
This point is important - the value of a log is inextricably tied to its unlikelihood. Which depends on so many things in the context.
This sounds more like metrics than a log statement.
For me logs should complement metrics, and can in many instances be replaced by tracing if the spans are annotated sufficiently. But making metrics out of logs is both costly and a bit brittle.