Hi,
first you must know which syslog facility you are using to send the syslog events over to LEM.
Ensure that this facility is not used by other applications sending syslog events to LEM to ensure no overlapping of logs found.
Then under appliance > connector. Create a connector meant for AudioCodes Mediant 1000.
Under logfile: input "/var/log/localX.log" where localX is the syslog facility used by AudioCodes to send syslog to LEM.
Under output: select Alert and nDepth.
If LEM does not have a correct connector type, use any connector that uses syslog or log a case and get support to create an appropriate connector.
Once properly setup and node is detected, you can view/query raw syslog messages under nDepth and change the slider (beside the > last 10min button) to Log Messages instead of Alerts.