We have an index that reads in log files from disk. Each logfile is its own source under the index, I want to create a basic health dashboard that shows the source name and when the last event/log was received and in the perfect world turn red if the last log was received more than x hours ago.
I currently have this set up with a single dashboard for each source, however, I would like to try and consolidate into a single dashboard.
Any help would be amazing
maybe a single panel will do,
try out this search:
| tstats max(_time) as last_event where index=* by source
| eval last_event_human = strftime(last_event, "%c")
| eval now = now()
| eval diff_in_seconds = now - last_event
| eval alert = if(diff_in_seconds>10,"alert","OK")
change the index=*
to your index
feel free to change the alert value (here 10 seconds) to your desired value
hope it helps
maybe a single panel will do,
try out this search:
| tstats max(_time) as last_event where index=* by source
| eval last_event_human = strftime(last_event, "%c")
| eval now = now()
| eval diff_in_seconds = now - last_event
| eval alert = if(diff_in_seconds>10,"alert","OK")
change the index=*
to your index
feel free to change the alert value (here 10 seconds) to your desired value
hope it helps