Is there a way to make an alert when a interesting field is no longer sending data?
index=your_index interestingField="*"
To fire alert, eventcount=0
eventcount=0