help creating an alert

[Sinistr0]

Hello! I have an idea of ​​creating an alert and would like the support of someone who understands, in elastic I have several indexes of extreme importance that receive logs at all times, and I would like to create an alert that alerts me when any of this index stops receiving logs, for example: the rule would monitor all these indexes and when one was not receiving logs for X time it would send an alert containing which index is not receiving logs.
Is it possible to do this in elastalert? if yes, how?

[jertel]

Yes, ElastAlert 2 supports this via the flatline rules. See the docs for more information.

[Sinistr0]

oh thanks!, I took a look at the flatline, but in this method the alert will send the name of the index that stopped sending logs?
for example in the configuration of the rule is configured

index: "index1*,index2*,index3*".

and the alert should send the name of the index that is not receiving log.

[jertel]

You will need to create one rule per index.