E-mail when alert or drop

[abulafia]

I also had more success with

content<space>=<space>alert

i.e. without using quotation marks ""

[shinelee]

Use a reg expression to pull the dropped log. Before that, you Should be able to select the log file.