Regular expressions in EEM - Syslog pattern

[Links3000]

I'd like to know how I can match a syslog pattern of BGP neighbor down, without taking into account the actual IP address of the neighbor. The normal syslog message is as follows:

%BGP-5-ADJCHANGE: neighbor 1.1.1.1 vpn vrf outside Down

What I was hoping is I can use a regular expression character to match the syslog pattern as follows "%BGP-5-ADJCHANGE: neighbor & Down", but I have not read anywhere that this is possible. Not sure if this would require a separate syslog pattern, one for "%BGP-5-ADJCHANGE: neighbor" and one for "Down", or if there is a better way to go about this? Can someone assist?

[Dan Frey · Accepted solution]

This regexp will work if you want to match on any neighbor  IP.   

BGP-5-ADJCHANGE: neighbor [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\s+[A-Za-z\s]+ Down

[Links3000]

Thank you!