We have an index "Server-Index" where we sometimes get a string indexed with the contents "foo". A few seconds later some other messages will get indexed as well that is tied to the "foo" string above. What we want to do is to trigger if "foo" appears and then aggregate the nextcoming messages that are related to the "foo" string for 5 minutes. Is this possible?
12:00 we receive a message containing "foo" <- Now we know something bad has happened and in a few seconds we will receive more messages that are related to the first message "foo".
12:01 2 message arrive which contain more information
12:02 4 more messages arrive which contain more information
12:05 we send an alert containing the "foo" string along with all the information provided in the messages receivied thereafter.
Is this possible, if so, what should i be looking at?