I have active check that checks logfile to exist one of two strings. And i have trigger that based on one of string. When last string have "corrupt" substring trigger must be false, oterwise - true.
Period of the check - 10 seconds, but really first or second strings appends to logfile ~every 30 minutes.
Trigger expression:

{HOST:log[/PATH_TO.log,"failed to read corrupt logfile|End mining logfile",,1000].count(#1,"corrupt","like")}

>0
Also i tries this:

{HOST:log[/PATH_TO.log,"failed to read corrupt logfile|End mining logfile",,1000].regexp("corrupt")}

What must to be:
When "corrupt" substring found in received string, trigger must change state to true. And must will be true, while next string without "corrupt" substring not received, when received, must be false, while corrupt string is not received.
What is really:
When any string received, trigger change it state to true or false, and keep this state <2 minutes. Next, trigger state changes to UNKNOWN,and keep this state while any string not received.