Double negation... oh thanks, I hate it. 
Your idea boils down to "negatively" tagging the "interesting" event in addition to it needing to be dropped.
1: importantWhenNotPresent
2: importantWhenNotPresent
3: importantWhenNotPresent
4: importantWhenNotPresent
5: importantWhenNotPresent
6: throttle
7: throttle importantWhenNotPresent
8: throttle importantWhenNotPresent
...
Maybe the following could work. It still looks like pain.
filter {
throttle { # decorates event if OUTSIDE bounds
key => "%{srcip}-%{dstip}-%{port}"
before_count => -1
after_count => 12
period => 60
max_age => 300
add_tag => "throttle"
}
throttle { # decorates event if OUTSIDE bounds
key => "%{srcip}-%{dstip}-%{port}"
before_count => 12 # same as after_count of previous throttle filter
after_count => 12 # same as before
period => 60
max_age => 300
add_tag => "importantWhenNotPresent"
}
if "throttle" in [tags] and "importantWhenNotPresent" in [tags] {
drop {}
}
# what remains are the events before throttle kicks in
# and the first event that is throttled (which does NOT contain the "important" tag)
}
Now we should be able to filter using tag "throttle" to get the first of each set of events that was throttled. Of course you could also send an email in output{} section and whatnot.
(Not tested yet. Did I mention it looks painful?)