If several messages were send to the log item one after another in a short time, and one of it matches trigger condition, than macro {ITEM.VALUE} for the corresponding event won't be calculated correctly.

Steps to reproduce using zabbix_sender:

1. Create log item (for example log[D:\datalog\test3.log]) and create a trigger for this item: {test_host:log[D:\datalog\test3.log].regexp(ERROR)}<>0
2. Create an action for this trigger with the {ITEM.VALUE} macro in "Operations"
3. Create txt file (data_values.txt) with the following contents:

    "test_host" "log[D:\datalog\test3.log]" 1481805381 "2016-12-15 14:40:49,187 WARN  [Test] TestMessage1"
       "test_host" "log[D:\datalog\test3.log]" 1481805381 "2016-12-15 14:41:12,187 WARN  [Test] TestMessage2"
       "test_host" "log[D:\datalog\test3.log]" 1481805381 "2016-12-15 14:42:13,187 ERROR  [Test] TestMessage3"
       "test_host" "log[D:\datalog\test3.log]" 1481805381 "2016-12-15 14:43:44,187 WARN  [Test] TestMessage4"
       "test_host" "log[D:\datalog\test3.log]" 1481805381 "2016-12-15 14:44:05,187 WARN  [Test] TestMessage5"
       "test_host" "log[D:\datalog\test3.log]" 1481805381 "2016-12-15 14:45:19,187 WARN  [Test] TestMessage6"

4. Send command:
   zabbix_sender -z 127.0.0.1 -i /tmp/data_values.txt -T

Results:

Trigger as expected turnes to the "Problem" state. But {ITEM.VALUE} macro in it's event is calculated wrongly. As {ITEM.VALUE} macro is displayed the last message (TestMessage6), not the one, that matched the trigger condition (TestMessage3). See screenshot event1.png.

Notes:

1. May be it's related to an issue I opened earlier - ZBX-11525
2. All values in this example have same nanoseconds too