Trouble setting up trigger for eventlog[].str() zabbix?

Question

linux

Good afternoon comrades.
And here I am again with another question. I don’t know what number this question is regarding zabbix-a, but you save me.
Actually such a thing.
It is necessary to catch event logs from windows to track the state (working, not working) of the application. The problem is that all eventid,severity,event source are the same and only the descriptions are different. Found that it is possible and according to the description using eventlog[].str()
The trigger works if you catch only one value as follows:
{Template name:eventlog[Security].str("A process has exited.")=1
But I need it to have one more value besides "A process has exited."
I'm trying to do this:
{Template name:eventlog[Security].str("A process has exited.","
doesn't work
Trying to do this
{Template name:eventlog[Security].str("A process has exited." & "Decoder.exe")=1
Doesn't work.
What do you advise?

Answer 1

I don’t think it’s still relevant, but you can combine conditions:
that is, {Template name:eventlog[Security].str("A process has exited.")=1 and {Template name:eventlog[Security].str("Decoder. exe")=1 i.e. the event contains one string and contains another.