We have a problem, that a part of our application stalls from time to time.
This results in no log lines. Normally we have multiple entries per second. When it stalls there are none.
Log lines are already indexed in elasticsearch.
Now I need to query the times, where no loglines are present.
Our data looks like this:
I would like to run a query like this:
- give me all time buckets (bucket size = 1s), where the count is 0.
Can I do this via kibana or elasticsearch?
I could use the count api and query each second, but I think there should be a better approach.