Auditbeat all enabled across multiple servers.
I am stumped as to how to set up a watcher that alerts me if a beat in a specific server goes down.
I've looked at
Heartbeat and looked at the
.monitoring-* index. But without any luck.
Central Management doesn't seem to have an alert feature.
Heartbeat only works for
.monitoring-* index has beat data but if the beat is down I won't be receiving data from it. An idea I had is to query
Filebeat monitoring data and if hit is 0 alert me.
But I am not sure if that's the best option or if it's practical.
Advice / recommendation would be appreciated.
Thanks in advance.