It would be great if we could use global regular expressions in triggers.
I need to receive unknown events from eventlog but only those that i need. So i can create a list (global regular expression) of events ID's that i don't need.
As we know different application(sources) can have same ID numbers. So we need to connect ID's numbers and application names.

And it would be much easier if we could use this triggers for events from specific application and with all ID's except the list from global expression @ID_EVENTLOG ...

{TESTCOMP:eventlog[System,,"Warning|Error"].logsource("WinHTTP")}=1&{TESTCOMP:eventlog[System,,"Warning|Error"].logeventid(@ID_EVENTLOG)}=0

... and this triggers for events from application that we don't know yet:

{TESTCOMP:eventlog[System,,"Warning|Error"].logsource(@APPLICAION_EVENTLOG)}=0

**@ID_EVENTLOG: ID that we don't whant to receive
**@APPLICATION_EVENTLOG: APPLICATION that we already know