I will help you create ElastAlert2 rules based on your requirements. I will provide you rule in .yml format.
5.010+
