Count with logstash

Logstash is the wrong place to do this. Have a look at Elastic's own Watcher product or the third-party ElastAlert produc.t