Alert when certain source didn't receive logs within x minutes

[gsmith]

Hello && Welcome @kien227

Yeah, only way that is possible, or close too what you want would be something like this.

Alternative View for Sources API Endpoint after 4.0

For very important logs I create an alert for each source. If the number of logs is below one for a certain timeframe the alert triggers, and includes the system it is monitoring. For less important logs I check for the cardinality of sources on the stream. If one is missing I’ll have an alert and a manual investigation, which one is missing. This is no machine-readable API though. :-/

I created a widget just for source count like this…

So if it drops or increases I do know a device was added or removed. I have to match the list of source from the day before.

Might want to check in Github or ask for a feature request here