No-data detection in Kibana Universal Alerting

No-data detection in Kibana Universal Alerting identifies sources that have gone silent, such as a host that stopped reporting metrics. A silent host produces no rows at all, so a threshold query has nothing to evaluate a condition against.

The pattern inverts the normal approach: use a broad lookback to find all known hosts, then surface only those that have not reported recently.

FROM metrics-*
| WHERE @timestamp >= NOW() - 12 hours
                                                  // Too short: silent hosts fall outside the window and are never checked.
                                                  // Too long: increases query cost on high-frequency data streams.
| STATS last_seen = MAX(@timestamp) BY host.name
| WHERE last_seen < NOW() - 15 minutes
                                                  // to avoid false positives from brief gaps
| KEEP host.name, last_seen

Cover the longest expected reporting gap for your hosts.
Find the most recent event timestamp per host
Silence threshold: set slightly above your expected maximum reporting interval
Each returned row is a silent host

Every row returned is a host that has gone silent. The query result itself drives the alert. A separate alert condition isn't needed.

Note

This pattern opens an alert for a silent source. To control what the rule does with an alert that already exists when its data stops, refer to No-data handling. That setting applies to each group. If a group with an alert stops reporting, the rule applies No data behavior to that alert, even when other groups keep reporting. It never opens an alert for a group that hasn't breached.

ES|QL query patterns: Browse query patterns ordered by complexity, from a basic event filter to SLO burn rate and persistent breach detection.
No-data handling: Configure what the rule does with an alert when its group has no data.

No-data detection in Kibana Universal Alerting

Related pages