alerts = stream
            .window(Durations.seconds(WINDOW_SIZE)) //5 sec window
            .filter((Event event) -> event.action.equals("denied")) // all events with action = denied
            //Now I need to count every pair (user,ip)
            // for instance if I have:
            //  3,Joe,denied,1.1.1.4
            //  4,Cloe,denied,1.1.1.5
            //  5,Joe,denied,1.1.1.4
           //   I want the aggregated events with the count value set: (_,Joe,"denied",1.1.1.4,2) and (_,Cloe,"denied",1.1.1.5,1)
            .filter((Event event) -> event.count >= 10); //after that I only need to filter-out events with count < 10