If i create an event manager applet to capture logs, i can work with a variable called $_syslog_msg. Example:event manager applet RUNATEVERYLOG
event syslog pattern "Configured programmatically" maxrun 4
action 1.0 cli command "enable"
action 2.0 put...