I am using the 'metricbeat' to pull data from several servers into a single E.S. instance, which works fine.
I have several visualizations in Kibana based on this info, but Kibana is set to only display data not older then 15 minutes, which I did on purpose.
Now assume one of the servers running Metricbeat goes down (meaning it will not send data anymore of course), it simply means that 15 minutes later Kibana will not find data anymore for this one server, as my settings only look at data no older then 15 minutes.
The result of that is that the visualization, thus the Dashboard, show a 'No results found' message.
What I would like to do is use a scripted field (which I already use anyway) to detect if a field exists. In the case I described above, it should return a default value, but no matter what I try, it will not do this.
I know that on the Discover tab you can use exists:"fieldname" but that does not work in a scripted field. I have also tried to use doc[f'ieldname'].empty (which should default to 0 if it does not exist per the documentation), but that does not seem to work either.
Any suggestions ?