Aggregation in Watcher

How do I cater for scenario in which an alert will be sent out when a source IP has appeared within a period of time for more than X number of time.


you could aggregate using a date histogram specifying your interval and a terms aggregation using min_doc_count. It highly depends on your document modeling, so showing an example would be useful.


Is there any update on this? Please share with a sample