# Alert if no logs received for each host

**URL:** <https://discuss.elastic.co/t/alert-if-no-logs-received-for-each-host/178285>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [April 24, 2019, 3:06pm UTC](https://discuss.elastic.co/t/alert-if-no-logs-received-for-each-host/178285 "2019-04-24T15:06:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![BKG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bkg/32/43591_2.png) [@BKG](https://discuss.elastic.co/u/BKG)\
**Post date:** [April 24, 2019, 3:06pm UTC](https://discuss.elastic.co/t/alert-if-no-logs-received-for-each-host/178285/1 "2019-04-24T15:06:15Z")

</div>

Hi,

Just wondering if someone knows how to be alerted if a host hasn't sent any logs in 10 minutes?

I've only seen examples where entire indexes haven't received any events, but I want to be able to detect individual hosts.

Thanks

---

<div class="post-metadata">

**Author:** ![LizaD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lizad/32/51074_2.png) [@LizaD](https://discuss.elastic.co/u/LizaD)\
**Post date:** [April 24, 2019, 5:14pm UTC](https://discuss.elastic.co/t/alert-if-no-logs-received-for-each-host/178285/2 "2019-04-24T17:14:58Z")

</div>

@Bamieh can you help with this?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [April 25, 2019, 6:12am UTC](https://discuss.elastic.co/t/alert-if-no-logs-received-for-each-host/178285/3 "2019-04-25T06:12:27Z")

</div>

hey,

a possibility would be to run a query from `now` till `now-20m` and then have two aggregations, that each aggregate on the hostname, however one is filtered on `now` till `now-10m` and the other from `now-10m` till `now-20m`. Then you could compare those buckets for missing hosts.

Hope this helps to give you an idea.

--Alex

---

<div class="post-metadata">

**Author:** ![BKG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bkg/32/43591_2.png) [@BKG](https://discuss.elastic.co/u/BKG)\
**Post date:** [April 25, 2019, 8:35am UTC](https://discuss.elastic.co/t/alert-if-no-logs-received-for-each-host/178285/4 "2019-04-25T08:35:10Z")

</div>

Ah good idea! I'll give it a go and post the alert once I have it working!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 23, 2019, 8:46am UTC](https://discuss.elastic.co/t/alert-if-no-logs-received-for-each-host/178285/5 "2019-05-23T08:46:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.