Hello and thanks in advance. I have a group of 100+ hosts with winlogbeat installed and sending events to elasticsearch cluster. Is there any options to generate an alert (on security or any other page) when one or group of hosts stop sending events to elasticsearch within a given period of time?

Alert when winlogbeat host stop sending events

stephenb (Stephen Brown) July 25, 2023, 5:29am 2

Perhaps take a look at this thread

Topic		Replies	Views
Alert if no logs received for each host Kibana elastic-stack-alerting	4	1256	May 23, 2019
Heartbeat Alerting Question Beats elastic-stack-alerting , heartbeat	5	726	May 23, 2019
Detecting and Alerting on Log Loss from Logstash or beats Logs	4	1985	February 13, 2020
Log Stoppage alert from critical server - ELK7.12 Elastic Security elastic-stack-alerting	7	1150	July 28, 2021
Winlogbeat event id missing Beats winlogbeat	5	510	January 17, 2022

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Alert when winlogbeat host stop sending events

Related topics