As I understand the flow of a log message in a device XML, the message must first match a header then the messageid must match id1. Upon the first match to a MESSAGE, the log message is parsed and the flow through the parser is finished and exits, and there is no addition attempts to match the log message, correct?
I'm now thinking of the remaining log messages that would become unknown. Could a default message then be placed at the bottom of the XML that would attempt to match the messages that we have no interest in and do not want to be classified as unknown? So these would not show up in runs of send_unknownmessages.cmd?