we use syslog parser to generate network device error events immediately on expression match.

However, some syslog errors comes every second and only the first error message have to generate the event immediately and all further errors that comes to the same device for the next three hours have to be ignored.
The problem is that we don´t want to wait 3 hours or 20 of the syslog errors, it must generated with the first match and after this syslog parser have to ignore the following errors for the next 3 hours.

How we have to use the match attributes "repeat Count", "repeatInterval" and "reset" to solve this? Any ideas?

thanks in advance