how to monitor the oracle alertlog in xml format, log.xml

[ik_zelf]

Since the log monitoring is a bit buggy and giving unreliable results when using the plain text file (alert_{ORACLE_SID}.log), now I am trying to divert to the newer xml format files, where a parseable timestamp is present.

The layout is:

</msg>
<msg time='2016-01-06T12:09:41.974+01:00' org_id='oracle' comp_id='rdbms'
 msg_id='kspdmp:18102:4222364190' type='NOTIFICATION' group='startup'
 level='16' host_id='CBR-PARC-002'
 host_addr='192.168.12.13'
 pid='24094'>
 <txt>ORACLE_HOME = /u01/app/oracle/product/12.1.0.2/dbhome_se2
 </txt>
</msg>
...
...
<msg time='2016-01-12T12:21:14.151+01:00' org_id='oracle' comp_id='rdbms'
 type='UNKNOWN' level='16' host_id='CBR-PARC-002'
 host_addr='192.168.12.13' pid='24094'>
 <txt>  Current log# 1 seq# 5146 mem# 1: +RECO/CPARC02/ONLINELOG/group_1.259.897830963
 </txt>
</msg>

I see that when I have no filter on the log item, all lines are read in and the timestamp is entered in the localtime column in zabbix but only for the line with '<msg time='. How can I refer to this localtime in triggers where I want to see if a certain error message like 'ORA-012345' popped up in the last hour (localtime).

Or, is there a way to fill the localtime based on the last value found in the stream?