One of the problems here is that Classifications are processed every 4 to 6 hours... so depending on the granularity of your alerts, you may alerted on data that hasn't yet processed (if basing it on a classification)
Can you clarify the format of your base eVar?
[brand name]|[zipcode]|...
Looking at your data through, it looks like you have a lot more pipes (|) then I would expect if you only have 6 fields (I see 12 pipes... if you are using || as a delimiter instead of just |, then the usage is inconsistent - I clearly see one pipe between values -unless "toyota|01071" is all part of the brand name... this is why I am asking for clarity around the format)
Now, I can see that there is data there much older than a few hours... and that your "Brand" classification is still unspecified... so are you asking for help to fix the Classification rules first (before even starting with alerts?)
In order to help with a regex, we really need to know the exact format the data should be expected to be provided in, and if there are expected to be special characters with the data (i.e. pipe in the values, double pipe is delimiter, etc)
