Alert When - system_fails_to_provide_data - dynamic group of sending hosts

Elastic Observability Logs
#1

I have a use case to alert when a host fails to send logs. There is a watcher configured here, which is similar to what I'm trying to achieve:

I like the logic, aggregate hosts on last 24 hours, then check for last 5 minutes.

However when trying to modify for filebeat-*, I am getting an error.
Is using watcher the best form of alerting, or is there a simpler/more elegant approach?

dynamic_sending_hosts_outage
dynamic_sending_hosts_outage971×802 20.4 KB

#2

I've moved this to the logs category, it was posted to Uptime which covers a different area.