Hello and thanks in advance. I have a group of 100+ hosts with winlogbeat installed and sending events to elasticsearch cluster. Is there any options to generate an alert (on security or any other page) when one or group of hosts stop sending events to elasticsearch within a given period of time?

Alert when winlogbeat host stop sending events

stephenb (Stephen Brown) July 25, 2023, 5:29am 2

Perhaps take a look at this thread

Topic		Replies	Views
Detecting and Alerting on Log Loss from Logstash or beats Logs	4	1983	February 13, 2020
Log Stoppage alert from critical server - ELK7.12 Elastic Security elastic-stack-alerting	7	1144	July 28, 2021
Winlogbeat event id missing Beats winlogbeat	5	510	January 17, 2022
Alert When - system_fails_to_provide_data - dynamic group of sending hosts Logs	6	605	April 2, 2021
Winlogbeat can't send events to Elasticsearch Beats	2	314	March 16, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Alert when winlogbeat host stop sending events

Related Topics