# Alert when not receiving logs

**URL:** <https://discuss.elastic.co/t/alert-when-not-receiving-logs/230973>\
**Category:** Kibana\
**Tags:** elastic-stack-monitoring, elastic-stack-alerting\
**Created:** [May 4, 2020, 1:02pm UTC](https://discuss.elastic.co/t/alert-when-not-receiving-logs/230973 "2020-05-04T13:02:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticwan](https://avatars.discourse-cdn.com/v4/letter/e/7cd45c/32.png) [@elasticwan](https://discuss.elastic.co/u/elasticwan)\
**Post date:** [May 4, 2020, 1:02pm UTC](https://discuss.elastic.co/t/alert-when-not-receiving-logs/230973/1 "2020-05-04T13:02:59Z")

</div>

Greetings,

Is there a way to be alerted when a set of hosts that were sending logs suddenly stop?

The ideal scenario would be to be automatically alerted (by email, or a visual alert in Kibana) when this happens. It is important for me to know when there are gaps in log reception.

Currently testing with a local installation of ELK 7.6

Thanks in advance

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [May 4, 2020, 2:13pm UTC](https://discuss.elastic.co/t/alert-when-not-receiving-logs/230973/2 "2020-05-04T14:13:19Z")

</div>

You can do an alert on "Count" of docs for the last interval (whatever interval you need). Let's say you have 100 log events per 10 minutes, you can put an alert for when the count goes lower than that over the last 10 minutes.

---

<div class="post-metadata">

**Author:** ![elasticwan](https://avatars.discourse-cdn.com/v4/letter/e/7cd45c/32.png) [@elasticwan](https://discuss.elastic.co/u/elasticwan)\
**Post date:** [May 5, 2020, 1:18am UTC](https://discuss.elastic.co/t/alert-when-not-receiving-logs/230973/3 "2020-05-05T01:18:06Z")

</div>

Thanks @Marius_Dragomir for the reply!

> You can do an alert on "Count" of docs for the last interval

That's using Watcher right?

Also, is there a way to "query" or "flag" for doc count = 0 when building a TSVB visualization?

Thanks!

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [May 5, 2020, 1:20pm UTC](https://discuss.elastic.co/t/alert-when-not-receiving-logs/230973/4 "2020-05-05T13:20:46Z")

</div>

That is with watcher/ alerting(in newer versions of kibana, more user friendly 🙂 )  
Other than displaying them as 0 there's nothing else you could do in TSVB.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 2, 2020, 1:21pm UTC](https://discuss.elastic.co/t/alert-when-not-receiving-logs/230973/5 "2020-06-02T13:21:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.