SCOM Event Rule, Generic Text Log

Dashboard Server
1

Can you create a Generic Text Log with an OR group and an AND group? I need to match one of severial criteria and exclude one.
Example
OR Group
-Contains Error
-Contains Warning
AND Group
-DoesNotContain Rollback

Each time I create something like this is accepts it but then going back the second expression group is missing and the criteria is rolled into the first expression group.

I think the workaround is to break this into multiple rules, just want to check first if that is the only way to go.

2

Condition Detection Expressions do support a nested OR, so that is indeed one way to go. If you are calculating health (best practices) however and Warning in the logs = Warning health, then you would have 3 CDs and then you wouldn’t need the OR (if what I read is correct)