---
title: No-data detection in the experimental alerting system
description: Detect silent hosts and stopped data sources in the experimental alerting system using ES|QL last-seen queries.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/experimental-alerting-system/rules/esql-no-data-detection
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Experimental
  - Elastic Stack: Planned
---

# No-data detection in the experimental alerting system
No-data detection identifies sources that have gone silent, such as a host that stopped reporting metrics. A silent host produces no rows at all, so a threshold query has nothing to evaluate a condition against.
The pattern inverts the normal approach: use a broad lookback to find all known hosts, then surface only those that have not reported recently.
```esql
FROM metrics-*
| WHERE @timestamp >= NOW() - 12 hours           
                                                  // Too short: silent hosts fall outside the window and are never checked.
                                                  // Too long: increases query cost on high-frequency data streams.
| STATS last_seen = MAX(@timestamp) BY host.name 
| WHERE last_seen < NOW() - 15 minutes           
                                                  // to avoid false positives from brief gaps
| KEEP host.name, last_seen                      
```

Every row returned is a host that has gone silent. The query result itself drives the alert. A separate alert condition isn't needed.
<note>
  This pattern detects specific silent sources. For controlling what the rule records when the entire base query returns zero rows, for example when an index is completely empty, refer to [No-data handling](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/experimental-alerting-system/rules/configure-no-data-handling).
</note>


## Related pages

- [ES|QL query patterns](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/experimental-alerting-system/rules/esql-query-patterns): Browse query patterns ordered by complexity, from a basic event filter to SLO burn rate and persistent breach detection.
- [No-data handling](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/experimental-alerting-system/rules/configure-no-data-handling): Configure what the rule records when the base query returns zero rows.