Script looks OK but do you need to run "on message arrival” rather than "on overdue age” ?
If you are doing this on every alarm, you might like to try doing this in Pre_processing section and use the event.origin construct but it might slow things down so hopefully you don't have too many alarms being processed..
Custom Pre-Processing
The event table is placed into the LUA context prior to executing the "custom” pre-processing rule. You may alter (launder) the event by setting the fields message, level, sid, source, hostname, user_tag1, user_tag2, visible, custom_1 to custom_5, supp_key and origin. The following fields are present for the script to use:
.source - source of the alarm (typically ip-address)
.hostname - resolved name (robotname or ip-address to name resolution)
.level - severity level (0-5)
.sid - subsystem identification.
.message - alarm message text.
.origin - origin of the alarm (stamped by nearest hub, or in some cases the robot.)
.domain - name of originating NimBUS domain.
.robot - name of the sending robot.
.hub - name of the nearest hub to the sending robot.
.prid - name of probe issuing the alarm.
.user_tag1 - user tag 1 (as set by robot).
.user_tag2 - user tag 2 (as set by robot).
.supp_key - suppression identification key.
.visible - flag for visibility (true = visible)
The script is expected to return the event (modified or not) or nil. The nil will indicate that the event is to be skipped.