hehe, me too, I had it working, but for some reason…
I noticed that the first example above defines the filter for LOGFILE. Now my understanding is that this doesn’t make sense, because those events are written to events.log/EVENT so I moved the line (after it didn’t worked as expected). Then I tried @ssalonen’s approach, but this also doesn’t work.
I tried with and without brackets. In fact () puts the result in group 1. Filters :: Apache Log4j shows an example without (), but I tried both.
This drives nuts 
@ssalonen @wborn Do you have an idea what’s wrong with my config above?