alert based on match count on log file

Is it possible to get an alert only when 'cannot connect to remote server'
shows up more than 5 times in last 5 mins?

So kind of an improvement over LOG on analysis.cfg with a COUNT field like
below

LOG /var/log/daemon.log %cannot.connect.to.remote.server COUNT>5

Thanks

-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?