Alert checking for 0 documents stopped firing

We have been running an alert that checks for 0 new documents over a specific time and sends an email. This worked fine but seems to have stopped working right after we updated our stack to 7.13.4.

The email function works fine and if we define the condition for the same index but with above instead of below it triggers (if set apprioprietely).

We have tried using both is below 1 and is below or equals 0, neither works anymore, but it used to.

Does anyone have an idea how to fix this? Is it a bug introduced in the 7.13.4 version?
Is there another way to monitor for no activity in an index to get around this issue?

Here is one example of settings that used to work:

This looks exactly like a known bug: index threshold rule does not work as expected with a threshold below a value · Issue #103922 · elastic/kibana · GitHub

The fix for this will be available in 7.14.1

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.