# Do a query that shows when a value appears n or more times **URL:** \ **Category:** Elasticsearch\ **Created:** [May 14, 2018, 9:21pm UTC](https://discuss.elastic.co/t/do-a-query-that-shows-when-a-value-appears-n-or-more-times/131813 "2018-05-14T21:21:14Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![prodrg](https://avatars.discourse-cdn.com/v4/letter/p/3bc359/32.png) [@prodrg](https://discuss.elastic.co/u/prodrg)\ **Post date:** [May 14, 2018, 9:21pm UTC](https://discuss.elastic.co/t/do-a-query-that-shows-when-a-value-appears-n-or-more-times/131813/1 "2018-05-14T21:21:14Z")
Hi guys, I need help formulating a specific query, or at least to know if something like is possible. Let's say I have the following lines on my logs 123.234.134.42 -- es-ar -- pizza 123.234.134.42 -- es-mx -- pizza 123.234.134.42 -- us-us -- pizza 123.234.134.42 -- es-cr -- pizza 123.234.134.42 -- fr-fr -- pasta 123.234.134.42 -- fr-fr -- pasta 123.234.134.42 -- pt-br -- pasta I need to alert when an IP access to the same product three (or n) or more times but using different languages. So, using above example, it would alert that 123.234.134.42 accessed pizza, because the IP used es-ar, es-mx, us-us and es-cr languages. But, it wouldn't alert when it accessed pasta, because although he accessed the product three or more time, he only accessed in two different languages. I don't really know how can I set that threshold. Thank you ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 11, 2018, 9:21pm UTC](https://discuss.elastic.co/t/do-a-query-that-shows-when-a-value-appears-n-or-more-times/131813/2 "2018-06-11T21:21:14Z")
Closed on June 11, 2018, 9:21pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.