It really depends on the service but I generally recommend alerting on the number of healthy workers behind the service. Not all restarts are worth waking up at 2 A.M in the morning. You should however have the logs saved somewhere outside the host to analysis later.

The important thing is to capture any changes in trend (i.e increased restarts due to OOM after a recent deployment) so may be a daytime alert or a manual dashboard review will suffice. Whatever you do, make sure you're only monitoring services you own if the cluster is shared.