I'm using bosun in version 0.2.0 and the following query to check for grok parse failures:

lscount("logstash", "domain", "tags:_grokparsefailure", "5m", "5m", "") * 600

This works fine as long as there are documents with the specific tag. But if not, the result seems to be an empty set instead of 0. As a consequence, any alarm on this query never get back to normal / green.