Graylog 3.2 alert when host drops off

[ttsandrew]

There’s a content pack for this but I could never make it work correctly. Maybe you’ll have better luck.

Event definition help

I’m trying to set up event definitions so that an alert is generated if no messages are received from a source within a timeframe. I thought I could do this using an aggregation and setting the trigger to less than a number, but it isn’t working. Also, ideally I would like this to use a static list of sources so that the query can execute dynamically against that list and generate an alert for each that qualifies. Has anyone else done this? Any idea if it’s possible? I’m not having a lot of luck…