# Need to get the list of hosts not sending the logs to kibana

**URL:** https://discuss.elastic.co/t/need-to-get-the-list-of-hosts-not-sending-the-logs-to-kibana/266922
**Category:** Kibana
**Created:** [March 11, 2021, 10:24am UTC](https://discuss.elastic.co/t/need-to-get-the-list-of-hosts-not-sending-the-logs-to-kibana/266922 "2021-03-11T10:24:31Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![mbm\_wfm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mbm_wfm/32/79152_2.png) [@mbm\_wfm](https://discuss.elastic.co/u/mbm_wfm)
#### Post date: [March 11, 2021, 10:24am UTC](https://discuss.elastic.co/t/need-to-get-the-list-of-hosts-not-sending-the-logs-to-kibana/266922/1 "2021-03-11T10:24:31Z")

</div>

Hi,

I need to get list of hosts not sending logs over two days for example, a query with kibana would be awesome!

---

<div class="post-metadata">

### Author: ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)
#### Post date: [April 1, 2021, 2:41pm UTC](https://discuss.elastic.co/t/need-to-get-the-list-of-hosts-not-sending-the-logs-to-kibana/266922/2 "2021-04-01T14:41:50Z")

</div>

This isn't possible with most standard logs-oriented indices, because to run this query you need to have a host-oriented index that has a structure like this:

`{ host: 1, last_known_date: 2021-03-15` }`

There is a feature that you can use in Elasticsearch to solve this problem. [Transforms](https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html) let you pivot by host

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 29, 2021, 2:42pm UTC](https://discuss.elastic.co/t/need-to-get-the-list-of-hosts-not-sending-the-logs-to-kibana/266922/3 "2021-04-29T14:42:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
