Hi guys, I need help formulating a specific query, or at least to know if something like is possible.
Let's say I have the following lines on my logs
123.234.134.42 -- es-ar -- pizza
123.234.134.42 -- es-mx -- pizza
123.234.134.42 -- us-us -- pizza
123.234.134.42 -- es-cr -- pizza
123.234.134.42 -- fr-fr -- pasta
123.234.134.42 -- fr-fr -- pasta
123.234.134.42 -- pt-br -- pasta
I need to alert when an IP access to the same product three (or n) or more times but using different languages. So, using above example, it would alert that 123.234.134.42 accessed pizza, because the IP used es-ar, es-mx, us-us and es-cr languages. But, it wouldn't alert when it accessed pasta, because although he accessed the product three or more time, he only accessed in two different languages.
I don't really know how can I set that threshold.
Thank you