Log Source Stopped Working

[tortnike.e]

Hello Guys,

How do you monitor log sources? I need to monitor some of Data Streams, when they are not sending logs, I need to be alerted. What do you suggest?

I have created esql rule but sometimes it is not woking:
FROM logs-hashicorp_vault.audit-default
| WHERE @timestamp > NOW() - 24 hours
| STATS count = COUNT(*)
| WHERE count == 0

[val (Val Crettaz)]

Hey, here is a question on a similar topic that has a good answer

Alerting when data stops coming in from variety of sources

I've had some issues in the past while trying to use the built-in threshold alert, it missed the alerts a lot of time, generated some false positive about the data recovering when it didn't recover. Afte some tickets with support with no solution and they not being able to replicated we gave up and looked for other ways to alert on the data. What solved our problem was using ES|QL security rules that will trigger based on the difference from the time when the rule is executed and the last even…