Something like this is what I used just filtering the message create a preprocess rule looking for sid 1.2.1.3 for the tunnels and 1.2.1.2 for the queue errors if need be and point at the script your write.
if string.find(event.message,"10.1.127.70") then
event.user_tag1 = "new usertag"
event.user_tag2 = "aother usertag"
event.message = "Can't connect with my customers hub"
printf ("Modifing usertag for otj")
elseif string.find(event.message,"anotherhost") then
event.user_tag1 = "new usertag"
event.user_tag2 = "aother usertag"
event.message = "Can't connect with my customers hub"
printf("modifing another host")
return event