Hi,
Hi, Im using Metricbeat 7.9 and Elastalert for filesystem usage for each mountpoint. I also want to add alerting when linux service is stopped, so I enabled "- service" and "-process" in metricbeat.reference.yml. When I look to metricbeat index, it works and I see entries like "nginx - sleeping". I tried to test the alert so I stopped the nginx service, but when I look to the metricbeat index I dont see any new entries for nginx, it just stopped logging new entries for nginx, so my alert cant be activated because its set to send alert when the entry for service status is "dead". Can anybody help me with this please?