Fix check - fire if no new logs for 5 data points

As it stands logs are too bursty and the check frequency is too fine -
we are getting intermittent alerts due to no logs for a very short
period of time.

Do we definitely need the removebelowvalue? I understand about the switch overnight but this is brief and alerts about indexes decreasing in size normally could be useful?