So whenever an Echolink node connects directly to any of my nodes (repeaters/gateways) I can run a macro to log the event. I switched from RPT_LINKS to RPT_ALINKS to capture only the direct (adjacent) connections. RPT_ALINKS outputs the node number without the leading 'T'.
The Asterisk CLI indicated problems whenever I tried any standard RegEx commands so I just used '3......' The number 3 followed by 6 dots in the expression. i.e. Starts with the number 3 then any characters/numbers for the next 6.