Is this something addressing your questions shorturl.at/tySTZ
Not an out of box solution though.
It is consolidating alerts, discovering patterns and grouping related alerts to cases.
For your question: it extracts ip and groups 100500 alerts to one case and write to ELK case page.