Trigger not working correctly when item sends multiple log entries at once

[selvesteespen]

Hi,
I'm new to Zabbix and have ran into a problem that I haven't been able to resolve.
I have a Windows server where I run a Python script every 10 minutes. The script goes through 4-500 service and checks the state. The results are written to a log file.
The logfile contains info such as this:
2024-11-20 00:00:04 | INFO | Group: EG Fabri - bmh, Prod: bmh_logon-backend, URL: https://logon-backend.bmh.egapps.no/actuator/health, Response Code: 200, Response Text: {"status":"UP"}, Response Time: 0.14 seconds

I've set up an item in the Zabbix agent which basically pulls all the new entries from the logfile and sends them to Zabbix Cloud in this format:
2024-11-20 00:00:04 EG Fabri - bmh, Prod: bmh_logon-backend, URL: https://logon-backend.bmh.egapps.no/actuator/health, State: 200
The item is set with a 1 minute interval.

I've then tried to create a trigger which should fire if a line contains a state other than 200.
The trigger fires, but it shows the wrong value. I've used {ITEM.VALUE}
Is this because the values from the log are sent in as one "block"? So when the trigger fires it shows the value for the last line in the "block"?

Not sure how I should resolve this in the best possible way.
I could of course set the item up so that it only sends log-lines where state is not 200, but I really want the trigger to resolve the problems automatically when an endpoint goes back to returning state 200.

I would really appreciate any input on how to proceed with this.

Regards
Espen B Hanssen
Zabbix Newbie

[cyber]

What item you use for pulling the logfile entries? logrt? In that case all lines shoudl be as separate value, not a block of text...
But you shoudl use {ITEM.LASTVALUE}

When used in the problem name, the macro will not resolve to the latest item value when viewing problem events; instead, it will keep the item value from the time when the problem happened.

[selvesteespen]

Using logrt so I'm a bit puzzled as to why it doesn't seem to work as intended.
Might alter my approach and set up discovery of each endpoint and then use item and trigger prototypes.