ParentFull threadLiuser·Unless I'm misunderstanding your comment, isn't that a flatline type of alert, which is supported by Elastalert?View on HN