@Anonymous Yes, I did think about "_internal" index, the problem is that, that's historic data right? E.g., there were 3 running indexers, then we would see events from all of them, so there would be 3 values (of course there will be more if includes SHs). Then one of the indexer is down, from SHs, I'd like to know it's really down or removed from indexer cluster. Seems it's impossible to get the information from _internal index? As whether the indexer is down, or actually removed from the cluster, we will not see any events from it been indexed to "_internal" index.
... View more