Zabbix Log Monitoring - How to extract "keyword" in action

[vigneshn]

I want to create an Item for log monitoring, use 1 common trigger for all matching keywords and use Action to extract the "keyword" dynamically.

Item:
logrt["/tmp/messages$","error|Timeout|down|fail|LED|fmd|duplic ate|write|Manual|process is stuck|Deasserted|Device Absent|V-14-1-10205",,100]

Trigger if string is identified and close the alert in 30 minutes:
str() > 0 and nodata(30m)=0

Queries:
1. Will above solution work and create multiple alerts?
2. What is the impact if this is monitored across 3000 client servers?
3. How to extract the "keyword" dynamically and use it in automated actions?

Thanks.

[vigneshn]

I managed to extract the value of the item (the exact log line that triggered the alert) in Actions by adding the below parameters in "Operations" of the Action and passing it as script parameters in the Media:

Item Value: {ITEM.VALUE}
Item Lastvalue: {ITEM.LASTVALUE}

I still want to understand how much performance impact the log monitoring in 3000 UNIX servers will have in the Zabbix agents and the Zabbix proxy/server components. Any suggestion or feedback is welcome.

Thanks.