# Alerts on Missing heartbeats **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-alerting\ **Created:** [November 13, 2018, 10:21pm UTC](https://discuss.elastic.co/t/alerts-on-missing-heartbeats/156556 "2018-11-13T22:21:28Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![jpresley](https://avatars.discourse-cdn.com/v4/letter/j/b38774/32.png) [@jpresley](https://discuss.elastic.co/u/jpresley)\ **Post date:** [November 13, 2018, 10:21pm UTC](https://discuss.elastic.co/t/alerts-on-missing-heartbeats/156556/1 "2018-11-13T22:21:28Z")
We would like to alert when there is a heartbeat missing in our logs and we would like to create a visualization for the status of our connections. We know a heartbeat is successful when we log a string in our logs. There are multiple heartbeats spread across multiple log files. We have not created a predetermined list of connections and nor do we have a map for our log file naming conventions. We would expect one connection per log file. The strings within a log file are: 35=A is a login 35=5 is a logout 35=0 is a heartbeat. What's the general approach we can take for this type of monitoring? I'm comfortable enough with the Query DSL, Visual Builder, and Watcher but have yet to figure out how to visualize or alert when there is an absence of something for a time series. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 14, 2018, 4:41am UTC](https://discuss.elastic.co/t/alerts-on-missing-heartbeats/156556/2 "2018-11-14T04:41:53Z")
If you expect a heartbeat every (eg) 1 minutes, then you can simply check the last 90 seconds (just to give you a bit of room) and if there's nothing found generate an alert? ---
**Author:** ![jpresley](https://avatars.discourse-cdn.com/v4/letter/j/b38774/32.png) [@jpresley](https://discuss.elastic.co/u/jpresley)\ **Post date:** [November 14, 2018, 6:39pm UTC](https://discuss.elastic.co/t/alerts-on-missing-heartbeats/156556/3 "2018-11-14T18:39:44Z")
The challenge is that I'm not sure whether there's a way to get current values to compare whether one is missing. Or if I need a whiteliist, I'm not sure how to visualize missing data. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 14, 2018, 10:59pm UTC](https://discuss.elastic.co/t/alerts-on-missing-heartbeats/156556/4 "2018-11-14T22:59:40Z")
That's why there was an implied question there, how often do you expect heartbeats. ---
**Author:** ![jpresley](https://avatars.discourse-cdn.com/v4/letter/j/b38774/32.png) [@jpresley](https://discuss.elastic.co/u/jpresley)\ **Post date:** [November 14, 2018, 11:22pm UTC](https://discuss.elastic.co/t/alerts-on-missing-heartbeats/156556/5 "2018-11-14T23:22:17Z")
For each socket, we expect heartbeats every 30s to a 1 minute. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 15, 2018, 1:25am UTC](https://discuss.elastic.co/t/alerts-on-missing-heartbeats/156556/6 "2018-11-15T01:25:42Z")
Ok, then you can use something that looks for hosts that have no values in the last N seconds, as that implies a missing heartbeat. Something like [https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches/monitoring\_cluster\_health](https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches/monitoring_cluster_health) or [https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches/new\_process\_started](https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches/new_process_started) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 13, 2018, 1:25am UTC](https://discuss.elastic.co/t/alerts-on-missing-heartbeats/156556/7 "2018-12-13T01:25:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.