You can use this to get the last connected time and set a threshold to 60 seconds or more based on your configuration.
index=_internal |bucket _time span=1m | eval timenow=now() | convert timeformat="%b %d, %Y %H:%M:%S" mktime(_time) as LastInfoEvent mktime(timenow) AS currentTime| eval secondsSinceLastKeepAlive=(currentTime-_time) | stats min(secondsSinceLastKeepAlive) as secondsDead by host| sort secondsDead DESC
... View more