How to get Forwarder Event Detection within a specific period of time?

[cboillot]

We are trying to develop a solution that will allow us the ability to be notified when a forwarder has not sent an event within a specific period of time? We need to find a way to ensure our forwarders are sending log events.

Has anyone done something like this? What would be the best way to go about this?

[adonio · Accepted solution]

hello there,

there are many solutions around it, and many answers here around this topic.
here is a quick and dirty solution i use:

| tstats count where index=_internal by host

that will let you know there is a connection since the forwarders always sends their internal logs, so you can run it and see if count is 0 in a period of time then you might want to check that forwarder
another way i report on last event seen from a forwarder is:

| tstats max(_time) as last_event where index=_internal by host
| eval now_time = now()
| eval event_secondes_ago = now_time - last_event

if you care about the data a forwarder sends to the data indexes, change index=_internal to index=*
you can go many ways from here

hope it helps