Alert no ingestion from feeds

Hi,

I’m triying to create an alert that indicates when there’s a lack of logs from a feed source.

Basically my idea was:

rule DEV_FEED_LACK_OF_DATA {
  meta:

    author = 
    description = 
    severity = "Critical"


  events:

    $e.metadata.log_type = "Office_365"
    $Type = $e.metadata.log_type

  match:
    $Type over 4h

  outcome:
    $risk_score = 90


  condition:
    !$e 
}

But following the docs i have that:

https://docs.cloud.google.com/chronicle/docs/yara-l/condition-syntax#requirements_for_non-existence_queries

For a non-existence query to compile, it must satisfy the following requirements:

• At least one UDM event must have a bounded condition (that is, at least one UDM event must exist).
• If a placeholder has an unbounded condition, it must be associated with at least one bounded UDM event.
• If an entity has an unbounded condition, it must be associated with at least one bounded UDM event.

So from my basic idea i suppouse i have to get another event with the same $TYPE that exists to do in the condition something like $e and !$e1

Can someone have an idea of how to solve this issue?

Best regards