Combine results from same IP

[chake]

I would like to combine results from the same IP address. So lets say someone tries to do a brute force attack and after 20 attempts he found the correct password and can login. I would like to combine this login failures with the login accepted without adding an IP address in my query.

[123dev]

See if this could help

Graylog