Sorry that was indeed confusing on my part. Also, I think what I want is impossible to achieve but I will try to explain just in case it's not.
I will use the field file (generated by filebeat) instead of server_name.
I have a filebeat that will collect from several .log files (in the same diectory).
What we want is a way to show us that one file hasn't sent any log in a 24h time frame for example.
Right now, if I make a table showing the counts for every values of file, it will show me all values that has at least one count. However, that means all the files that have 0 count won't show up at all.
So basically we want a way to have these files appear in the table anyway.
Or maybe a way to query for those files, like "count_sum:0" or something like that.