Cookie Counting

That presents a special problem with regard to HTTP as a stateless protocol. Since any single HTTP request is atomic and indistinguishable from any other request, you have to employ state mechanisms outside the original protocol specification to be able to correlate multiple HTTP requests. The absolute easiest option here is an HTTP cookie. You could set a cookie on first HTTP request and then look for it in subsequent requests.

when HTTP_REQUEST {
    if { not ( [HTTP::cookie exists MySiteCookie] ) } {
        set setcookie 1
        log local0. "IP: [IP::client_addr], Cookies: [HTTP::cookie count], UA: [HTTP::header User-Agent]"
    } 
}
when HTTP_RESPONSE {
    if { ( [info exists setcookie] ) and ( $setcookie == 1 ) } {
        HTTP::cookie insert name MySiteCookie value 1 path "/"
    }
}