Do a query that shows when a value appears n or more times

Elastic Stack Elasticsearch
1

Hi guys, I need help formulating a specific query, or at least to know if something like is possible.

Let's say I have the following lines on my logs

123.234.134.42 -- es-ar -- pizza
123.234.134.42 -- es-mx -- pizza
123.234.134.42 -- us-us -- pizza
123.234.134.42 -- es-cr -- pizza
123.234.134.42 -- fr-fr -- pasta
123.234.134.42 -- fr-fr -- pasta
123.234.134.42 -- pt-br -- pasta

I need to alert when an IP access to the same product three (or n) or more times but using different languages. So, using above example, it would alert that 123.234.134.42 accessed pizza, because the IP used es-ar, es-mx, us-us and es-cr languages. But, it wouldn't alert when it accessed pasta, because although he accessed the product three or more time, he only accessed in two different languages.

I don't really know how can I set that threshold.

Thank you

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.