# \_DataId Health Monitoring

**URL:** <https://discuss.elastic.co/t/dataid-health-monitoring/385914>\
**Category:** Elastic Security\
**Created:** [April 16, 2026, 7:48am UTC](https://discuss.elastic.co/t/dataid-health-monitoring/385914 "2026-04-16T07:48:36Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [April 17, 2026, 8:43am UTC](https://discuss.elastic.co/t/dataid-health-monitoring/385914/7 "2026-04-17T08:43:34Z")

</div>

Hello @saratsekhar

Index based threshold can be used but it will not serve your need...If i understand you usecase...

Index =\> ABC  
In this index we continuously receive data  
there is one field \_dataId \> this will have various values example \> windows/mac/os/android

Now the rule should run and tell that in last 15 minutes we have not received data for windows/mac if the count of these records are 0 ?

actually if the source is fixed (windows/mac/os/android) in that case we will have to go for Watcher as shared here :

> [@Watcher chain results not in the ctx.payload for a condition](https://discuss.elastic.co/t/watcher-chain-results-not-in-the-ctx-payload-for-a-condition/384574/2):
>
> Hello @Joey_Visbeen We can use the chain input job without transform , the action part needs to be updated as per your requirement along with the time range as it was used as 5h incase below code is as per the requirement (script part generated using LLM) - { "trigger": { "schedule": { "interval": "1m" } }, "input": { "chain": { "inputs": [ { "first": { "search": { "request": { "search\_type": "query\_th…

because in rule it will alert that last 15 minutes there is no data but for which source there is no data that output will not be possible.

Thanks!!

---

_[View the full topic](https://discuss.elastic.co/t/dataid-health-monitoring/385914)._