Mikrotik - Use /log to trigger Scripts "Who can solve this exciting task"

RouterOS Scripting
1

:frowning: {
:local top "hotspot,info,debug";
:local mes [/log get [ find topics="$top" ] message ];
:put ("$mes");
}

here ise one of the logs using New Terminal

command: /log print detail

time=12:59:09 topics=hotspot,info,debug
message="test (10.63.240.29): login failed: invalid username or password"

\

doesn't work, no mac

:foreach i in=[/ip arp find where dynamic=yes interface=bridge] do={
:local ip [/ip arp get $i address];
:put ($ip)
:if ([/log find where (message~" ($ip): login failed: invalid username or password")] != "") do={
:local mac [/ip arp get $i mac-address];
:put ($mac);
}
}

the next command, command and result copy from new terminal

[ersitizastes@Server] > :foreach i in=[/ip arp find where dynamic=yes interface=bridge] do={
{... :local ip [/ip arp get $i address];
{... :put ($ip)
{... :if ([/log find where message~" ($ip): login failed: invalid username or password"] = "") do={
{{... :local mac [/ip arp get $i mac-address];
{{... :put ($mac);
{{... }
{... }
10.63.240.30
08:2E:5F:75:6C:56
10.63.241.250
E4:58:E7:B5:60:11
10.63.240.29
5C:C9:D3:0D:D1:AD


#next command #

:foreach i in=[/log find where message~": login failed: invalid username or password"] do={
:local ip [/ip arp get $i address];
:local mac [/ip arp get [find address=$ip ] mac-address];
:put ("$ip ". "$mac")
}

result in "no such item"

:global ip [/ip arp get [ find interface=bridge dynamic=yes ] address];
:foreach i in=[/log find where message~"" ($ip): login failed: invalid username or password""] do={
:local mac [/ip arp get $i mac-address];
:put ("$mac")
}

no result

\

what I want to achieve is

  1. find /log message="test (10.63.240.29): login failed: invalid username or password"
  2. count /log messages
  3. get time from /log
  4. if 10 attemts to log in 2minutes result in login failes do action