get source files not updated in last 1 hour

[nani2rahul]

I want to get source files not updated in last 1 hour in specific host. Like in host java123 there are 2 logs /logs/abc.txt, /logs/def.txt. If they didn't update from past 1 hour i want an alert. how can i achive this.. I tried below one but it is showing all logs from all hosts.

| metadata index=* type=sources | eval age = now()- lastTime | where age > 3600

How to specify search for specific source files.

[sundareshr]

Something like this should work `| where age>3600 AND match(source, "/logs/(abc|def).

You could also do something like this to limit to a specific host(s)

index=* host=abc source=*abc* OR source=*def* earliest=-1h@h | stats count by source | where count=0