# Logstash Throttle logic

**URL:** <https://discuss.elastic.co/t/logstash-throttle-logic/49963>\
**Category:** Logstash\
**Created:** [May 13, 2016, 6:17am UTC](https://discuss.elastic.co/t/logstash-throttle-logic/49963 "2016-05-13T06:17:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\
**Post date:** [May 13, 2016, 6:17am UTC](https://discuss.elastic.co/t/logstash-throttle-logic/49963/1 "2016-05-13T06:17:24Z")

</div>

I wanted to throttle events so i only receive an event after 3 occurrences and i get no more than 5 in 180 seconds.

I am using below throttle condition/logic to generate an email alert. When i give the period is equal to 180 seconds, logic is able to throttle events based on key i.e.%{src\_ip}.

if ([eventid] =~ "4625") {  
throttle {  
before\_count =\> 3  
after\_count =\> 5  
period =\> 180  
key =\> "%{src\_ip}"  
add\_tag =\> "throttled"  
}   
}

The above condition works pretty well, but we are looking for events not to throttle for the same src\_ip for next 24 hrs, to avoid duplicate email alerts.

Kindly help on this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:57am UTC](https://discuss.elastic.co/t/logstash-throttle-logic/49963/2 "2017-07-06T04:57:44Z")

</div>