Unless I'm misunderstanding your comment, isn't that a flatline type of alert, which is supported by Elastalert?
No that is just if a value drops off, but that rule will never fire unless an event occurs in elasticsearch matching that query. I found this out the hard way