Aggregation Alert with condition

that is currently not possible with vanilla Graylog. You might want to add a feature request for that in Github.