What version of ELK are you using?
There's a couple different philosophies on this.
Alert when the telemetry (metricbeat doc count = 0 for some time interval group by host) is stopped sending. This tells you that metricbeat is not shipping telemetry but does is not necessarily mean the VM is down, perhaps a good indicator but not necessarily.
Another way to do this is use heartbeat and up time to ping to be VM externally to see if it is up and on the network.
2 related but slightly different approaches.
I asked about the version because the newer versions with the kibana alerting have an easy way alert when the telemetry stops