_DataId Health Monitoring

[Tortoise]

Hello @saratsekhar

Index based threshold can be used but it will not serve your need...If i understand you usecase...

Index => ABC
In this index we continuously receive data
there is one field _dataId > this will have various values example > windows/mac/os/android

Now the rule should run and tell that in last 15 minutes we have not received data for windows/mac if the count of these records are 0 ?

actually if the source is fixed (windows/mac/os/android) in that case we will have to go for Watcher as shared here :

Watcher chain results not in the ctx.payload for a condition

Hello @Joey_Visbeen We can use the chain input job without transform , the action part needs to be updated as per your requirement along with the time range as it was used as 5h incase below code is as per the requirement (script part generated using LLM) - { "trigger": { "schedule": { "interval": "1m" } }, "input": { "chain": { "inputs": [ { "first": { "search": { "request": { "search_type": "query_th…

because in rule it will alert that last 15 minutes there is no data but for which source there is no data that output will not be possible.

Thanks!!