I am shipping the data from, say 10 devices using Filebeat to an index ,say data-devices
Suppose the data format is as below from each device
"message": "log message goes here",
"device" : "device-01"
Assuming that now data is flowing from every device, when I do an aggregation on the "device" field on the index, I will get the list of all the 10 devices.
But, if two devices goes down (let us say device-04 and device-06 went down, or stopepd shipping logs for some reason),the same aggregation will result in the list containing 8 devices.
What I need here is to show the missing devices list in Kibana, as a table or any thing. How can this be done?