I wanted to throttle events so i only receive an event after 3 occurrences and i get no more than 5 in 180 seconds.
I am using below throttle condition/logic to generate an email alert. When i give the period is equal to 180 seconds, logic is able to throttle events based on key i.e.%{src_ip}.
if ([eventid] =~ "4625") {
throttle {
before_count => 3
after_count => 5
period => 180
key => "%{src_ip}"
add_tag => "throttled"
}
}
The above condition works pretty well, but we are looking for events not to throttle for the same src_ip for next 24 hrs, to avoid duplicate email alerts.
Kindly help on this.