Alerting when data stops coming in from variety of sources

[stephenb (Stephen Brown)]

Perhaps take a look at this

Alert on no data per source?

here @leandrojmp suggested a Log Threshold to get reported when no logs are added in the last 5 mins. This works but only if you add the specific source as a WITH condition. In my case I want to be reported on say 6 sources (but not 2 other stale sources in the index history). It seems it's not suitable in this case at least in the UI since you can only have WITH...IS...AND where the more suitable would be something like WITH source IN [a, b, c] and GROUP BY source. Is there any alternative bes…