Looking to build a logic which alerts whenever there is a log stoppage detected on Elastic through _dataId. I appreciate any suggestions here.

Hello @saratsekhar Welcome to the Community!! Can you please share more details about the data / alert needed? If you have datastream/index pattern we can create a dataview , we can create a rule & count the number of records with _dataId , if count < 1 in last 15 minutes than an alert should be …

Thank you, I need to create an alert that detects complete log stoppage from critical servers. Rather than monitoring specific hosts, I want to track by dataId. I attempted to use an index-based threshold rule with the condition set to trigger when document count falls below 1 within a specified t…

Hello @saratsekhar So if i understand it correctly _dataId is your server name ? If yes, what is the unique count of critical servers for which data is received & monitor is in place? Thanks!!

Hello, dataId is unique across log type like windows, linux, firewall, database, procxy etc. So need an alert whenever these dataIDs stop sending any log.

@Tortoise Index based threshold rule is recommended here?

Hello @saratsekhar Index based threshold can be used but it will not serve your need...If i understand you usecase... Index => ABC In this index we continuously receive data there is one field _dataId > this will have various values example > windows/mac/os/android Now the rule should run and t…

Thanks for providing the information, last statement is applicable for Threshold rule or a Watcher? because in rule it will alert that last 15 minutes there is no data but for which source there is no data that output will not be possible.

Hello @saratsekhar Below statement was for Rule : because in rule it will alert that last 15 minutes there is no data but for which source there is no data that output will not be possible As for Watcher example if you see there is fixed source which is added from where you expected the data to b…

thanks @Tortoise , could you please advise on the steps to create this in Watcher?

Hello @saratsekhar Please review the watcher shared in below link with similar usecase but has different values : [image] Watcher chain results not in the ctx.payload for a condition Elasticsearch Hello @Joey_Visbeen We can use the chain input job without t…

Discuss the Elastic Stack

_DataId Health Monitoring

Elastic Security

Tortoise April 21, 2026, 9:11am 11

Hello @saratsekhar

Please review the watcher shared in below link with similar usecase but has different values :

Thanks!!

1 Like

Topic		Replies	Views
Log Stoppage alert from critical server - ELK7.12 Elastic Security elastic-stack-alerting	7	1303	July 28, 2021
Get Alert per Log of All Indexes - Watcher Elasticsearch elastic-stack-alerting	1	409	January 8, 2020
How to create alert when some component stopped to send data Elasticsearch	4	913	September 21, 2017
Alert on no data per source? Elasticsearch	12	629	March 28, 2025
Data source Not Sending Data Logstash	4	329	April 21, 2021

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

_DataId Health Monitoring

Related topics