filter { throttle { before_count => 30 period => 60 add_tag => "chill-out" } } output { if "chill-out" not in [tags] { pagerduty { ... } } }