No-data detection in the experimental alerting system

No-data detection solves a different problem from threshold alerting. A threshold query evaluates data that's present. No-data detection identifies sources that have gone silent. Threshold queries can't do this. A silent host produces no rows at all, so there's nothing to evaluate a condition against.

The pattern inverts the normal approach: use a broad lookback to find all known hosts, then surface only those that have not reported recently.

FROM metrics-*
| WHERE @timestamp >= NOW() - 12 hours
                                                  // Too short: silent hosts fall outside the window and are never checked.
                                                  // Too long: increases query cost on high-frequency data streams.
| STATS last_seen = MAX(@timestamp) BY host.name
| WHERE last_seen < NOW() - 15 minutes
                                                  // to avoid false positives from brief gaps
| KEEP host.name, last_seen
		

1. Cover the longest expected reporting gap for your hosts.
2. Find the most recent event timestamp per host
3. Silence threshold: set slightly above your expected maximum reporting interval
4. Each returned row is a silent host

Every row returned is a host that has gone silent. The query result itself drives the alert. A separate alert condition isn't needed.