How to create alert if no up alert received within 1 minutes?

[Raymundo]

I have two types of events when the interface is down and when it is up

It usually happens that the interface comes down, after 10 seconds it goes back up.

* An event arrives where it tells me that the interface is down
* Another event arrives where it tells me that the interface is up and it was down for 10 seconds.

I would like to alert if the interface does not come back up in a period of 1 minute.

I have tried several options but I have not been able to make it alert.

[gcusello]

Hi @Raymundo ,

I suppose that the messages are: system_down and system_up, otherwise adapt my search:

index=your_index (message="system_up" OR message="system_down")
| eval status=if(message="system_up","system_up","system_down")
| stats dc(status) AS status_count values(status) AS status
| where dc_status=1 AND status="system_up"

to run every minute.

Ciao.

Giuseppe