Here is what I do use to get last 5m log of massages that do contains: negotiation failed
You should be able to modify it to get the data you like
:local loglist [:toarray [/log find time>([/system clock get time] - 5m) message~"negotiation failed"]]