I've looked again at the regex for this, and I don't see a way to restricted this any more. The alert messages themselves contain unknown strings (like variable names from external input) and therefore couldn't having anything stricter that `.*`. The file part however, should be a PHP script on the system, so external user cannot inject something here.
Anchoring at the start of the line is also tricky, as this would depend on if you are using the filter with apache, lighttpd, etc.

I think, as long as the message regex post `ALERT - ` is greedy (as it is now), this should be safe as user input cannot occur in the file part.