No logs from Device

I currently have a rule called "no logs from device" and I expect this rule to be triggered when there is no log from a device, but a device went down and although it did not send logs for a while, the rule was not triggered, is there a custom rule you use for this situation or how can I use it more effectively?