Iam using elastic stack 5.5 to monitor the netflow and sflow and I have two separate indexes , I view them in kibana , for search and dashboards.
If i stop receiving the logs in the indexes, from logstash or the source itself stop sending the logs, in real time monitoring how can I use watcher to get notify me in email that this particular indexe is not getting events or logs ,so that I could necessary steps to see if the source is offline or my logstash got crashed.
Since I cant monitor the kibana in real time 24/7.
Any help would be really helpful
Thanks in advance,