# Alert when winlogbeat host stop sending events

**URL:** <https://discuss.elastic.co/t/alert-when-winlogbeat-host-stop-sending-events/339141>\
**Category:** SIEM\
**Created:** [July 25, 2023, 5:23am UTC](https://discuss.elastic.co/t/alert-when-winlogbeat-host-stop-sending-events/339141 "2023-07-25T05:23:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![vladislav](https://avatars.discourse-cdn.com/v4/letter/v/bbce88/32.png) [@vladislav](https://discuss.elastic.co/u/vladislav)\
**Post date:** [July 25, 2023, 5:23am UTC](https://discuss.elastic.co/t/alert-when-winlogbeat-host-stop-sending-events/339141/1 "2023-07-25T05:23:05Z")

</div>

Hello and thanks in advance.  
I have a group of 100+ hosts with winlogbeat installed and sending events to elasticsearch cluster.  
Is there any options to generate an alert (on security or any other page) when one or group of hosts stop sending events to elasticsearch within a given period of time?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [July 25, 2023, 5:29am UTC](https://discuss.elastic.co/t/alert-when-winlogbeat-host-stop-sending-events/339141/2 "2023-07-25T05:29:32Z")

</div>

Perhaps take a look at [this](https://discuss.elastic.co/t/no-data-alert/338315) thread

---

<div class="post-metadata">

**Author:** ![vladislav](https://avatars.discourse-cdn.com/v4/letter/v/bbce88/32.png) [@vladislav](https://discuss.elastic.co/u/vladislav)\
**Post date:** [July 25, 2023, 8:49am UTC](https://discuss.elastic.co/t/alert-when-winlogbeat-host-stop-sending-events/339141/3 "2023-07-25T08:49:32Z")

</div>

@stephenb still not sure how to trigger an alert only if a group of several hosts (5 out of 100) stop sending events.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [July 25, 2023, 2:47pm UTC](https://discuss.elastic.co/t/alert-when-winlogbeat-host-stop-sending-events/339141/4 "2023-07-25T14:47:04Z")

</div>

When you use the group buy / grouped over function that looks at each host separately. So all 100 hosts will be analyzed individually.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 22, 2023, 2:47pm UTC](https://discuss.elastic.co/t/alert-when-winlogbeat-host-stop-sending-events/339141/5 "2023-08-22T14:47:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.