I am monitoring a variety of components and have created visualisations to show whether the component is up, down or hasn't responded in a while. If the component is up or down, it sends a log to elastic search every minute with the field "Entry" set to true or false and the visualisation displays a green or red circle accordingly.. If the component has not answered in a while however, that circle is blank, since there is no data for it:
For this visualisation, I am splitting the chart by component name and then filtering by the value of the "Entry" field in the last log received for that component
and in the "response" section of the visualisation, I get this for a component that's been sending logs:
and this for a component with no logs
What I am trying to do is write a scripted field that will check if the Entry field exists in the document and if yes, return its value, otherwise return the value "no logs". Or a scripted field that would see if the doc_count = 0 and return the correct result. Any ideas?
P.S. this might be doable with json input, but I have no idea how to use that...