Thanks for all your help so far. I've narrowed down the problem to the event format recognizer. Unfortunately your solution while it works doesn't work in mine. Apparently, the issue is spaces. I tried using regex but it doesn't work. Is there something I'm doing wrong? My fortisiem is version 6.2.1.