We are monitoring multiple servers with metricbeat and we want to create an alert when no data is receiving from last 5 minutes. I have check Index Threshold type
But how we will check for each source ? We need to create one alert and within that alert we need to check for each source that is data is coming if not then we will assume that metricbeat is stopped in that server.
If anyone knows what could be the query for not receiving data from last 5 minute then it will also be fine.