Logging pipeline — алерт когда ingest rate упал

#!/usr/bin/env bash
# Compares 1-minute index document count delta against expected floor.
ES="${ES:-http://localhost:9200}"
INDEX_PREFIX="${INDEX_PREFIX:-logs-}"
MIN_DOCS_PER_MIN="${MIN_DOCS_PER_MIN:-100}"

NOW=$(date -u -d '1 min ago' +"%Y-%m-%dT%H:%M:%SZ")
COUNT=$(curl -sS -X POST "$ES/${INDEX_PREFIX}*/_count" \
  -H "Content-Type: application/json" \
  -d "{\"query\":{\"range\":{\"@timestamp\":{\"gte\":\"$NOW\"}}}}" \
  | python3 -c 'import json,sys; print(json.load(sys.stdin).get("count", 0))')

[ -z "$COUNT" ] && { echo "no-data"; exit 1; }
[ "$COUNT" -lt "$MIN_DOCS_PER_MIN" ] && echo "low $COUNT" || echo "ok $COUNT"