@techmanjon85, Try this:
With that, if these BGP syslog messages came in:
May 14 18:35:32: %BGP-5-ADJCHANGE: neighbor x.x.x.x Down User reset
May 14 18:35:40: %BGP-5-ADJCHANGE: neighbor x.x.x.x Up
That will do the rule. Unless you want specific rule for BGP UP and BGP DOWN.
Variables that you can use for the email action:
Hostname: ${Hostname}
IP address: ${IP}
Message Time: ${DateTime}
Message Type: ${MESSAGETYPE}
Message: ${MESSAGE}