4 ms·

Unless I'm misunderstanding your comment, isn't that a flatline type of alert, which is supported by Elastalert?

• yahyaheee 10y ago
  No that is just if a value drops off, but that rule will never fire unless an event occurs in elasticsearch matching that query. I found this out the hard way