Create a rule for stopped log alert

I'm trying to set up an alert for when my application logs haven't been updated in 1 hour. Could you please share the relevant query?

Hi @Bhavani90,

Welcome to the community! Are your application logs going into a single index or are they included with other application logs in an index?

You could check that the number of documents in the index is 0 for the last hour. There is a similar example in the Elasticsearch query alert documentation that can help you get started.

Hope that helps!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.