Can't to alarm in the first 3 times within 2 hours, the other ignored

[Anwar Xiao]

For check content, how to alarm in the first 3 times within 2 hours, the other ignored, as following:

check file syslog with path /var/log/syslog
        ignore content = "monit"
        if content = "^mrcoffee" then alert

Modify as like:

check file syslog with path /var/log/syslog
        ignore content = "monit"
        if content = "^mrcoffee" in 2 hours first 3 times then alert

[Anwar Xiao]

or like as :

if content = "^mrcoffee"  first 4 times within 50 cycles then alert   // the first 4 times  within 50 cycles
if content = "^mrcoffee"  after 4 times within 50 cycles then alert  // the after 4 times  within 50 cycles