# What is the best way to monitor log sources?

**URL:** <https://discuss.elastic.co/t/what-is-the-best-way-to-monitor-log-sources/131543>\
**Category:** Elasticsearch\
**Created:** [May 11, 2018, 10:35pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-monitor-log-sources/131543 "2018-05-11T22:35:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![addanuj](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@addanuj](https://discuss.elastic.co/u/addanuj)\
**Post date:** [May 11, 2018, 10:35pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-monitor-log-sources/131543/1 "2018-05-11T22:35:42Z")

</div>

Please suggest the best way of monitoring log sources, If any log source not sending logs more than 5 minutes then how can I get alerted or notified.

for Ex:

if any windows server is not sending logs for more than 5 minutes or if any Firewall log source is not sending logs for more than 5 minutes then i should get and alert.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 12, 2018, 12:59am UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-monitor-log-sources/131543/2 "2018-05-12T00:59:14Z")

</div>

Have a look at [https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches/system\_fails\_to\_provide\_data](https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches/system_fails_to_provide_data)

---

<div class="post-metadata">

**Author:** ![addanuj](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@addanuj](https://discuss.elastic.co/u/addanuj)\
**Post date:** [May 14, 2018, 5:45am UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-monitor-log-sources/131543/3 "2018-05-14T05:45:31Z")

</div>

HI Warkolm,

Thanks for your Reply,

Its working for me, but as usual i have multiple Indices and i need to monitor them all using single watcher, and i trying to print the message like if {ctx.metadata.watcherui.index} one of the index is not reporting then i should get an alert.

Please let me know how i can monitor all Indices using single watcher.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 11, 2018, 5:45am UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-monitor-log-sources/131543/4 "2018-06-11T05:45:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.