diff --git a/pyproject.toml b/pyproject.toml
index 86aef0f0..0d29092c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -81,7 +81,8 @@ dependencies = [
     "tenacity",
     "termcolor",
     "tqdm",
-    "xmltodict"
+    "xmltodict",
+    "typing-extensions"
 ]
 
 [project.urls]
diff --git a/src/chtools/monrun_checks/ch_log_errors.py b/src/chtools/monrun_checks/ch_log_errors.py
index 7ef2a747..1f769fc9 100644
--- a/src/chtools/monrun_checks/ch_log_errors.py
+++ b/src/chtools/monrun_checks/ch_log_errors.py
@@ -61,7 +61,8 @@ def log_errors_command(crit, warn, watch_seconds, exclude, logfile):
             match = regex.match(line)
             if match is None:
                 continue
-            if datetime.strptime(match.group(0), "%Y.%m.%d %H:%M:%S") < datetime_start:
+            date = match.group(1)
+            if datetime.strptime(date, "%Y.%m.%d %H:%M:%S") < datetime_start:
                 break
             errors += 1
 
diff --git a/tests/features/monrun.feature b/tests/features/monrun.feature
index d7a4f010..4006986c 100644
--- a/tests/features/monrun.feature
+++ b/tests/features/monrun.feature
@@ -150,89 +150,88 @@ Feature: ch-monitoring tool
     0;OK
     """
 
-# TODO ORION-1000
-#  Scenario: Check Log errors
-#    When we sleep for 30 seconds
-#    And we execute command on clickhouse01
-#    """
-#    ch-monitoring log-errors -n 20
-#    """
-#    Then we get response
-#    """
-#    0;OK, 0 errors for last 20 seconds
-#    """
-#    When we execute query on clickhouse01
-#    """
-#    SELECT 1;
-#    """
-#    And we sleep for 5 seconds
-#    And we execute command on clickhouse01
-#    """
-#    ch-monitoring log-errors -n 20
-#    """
-#    Then we get response
-#    """
-#    0;OK, 0 errors for last 20 seconds
-#    """
-#    When we execute query on clickhouse01
-#    """
-#    FOOBAR INCORRECT REQUEST;
-#    """
-#    And we sleep for 5 seconds
-#    And we execute command on clickhouse01
-#    """
-#    ch-monitoring log-errors -n 20
-#    """
-#    Then we get response
-#    """
-#    0;OK, 2 errors for last 20 seconds
-#    """
-#    When we execute query on clickhouse01
-#    """
-#    FOOBAR INCORRECT REQUEST;
-#    """
-#    And we execute query on clickhouse01
-#    """
-#    FOOBAR INCORRECT REQUEST;
-#    """
-#    And we execute query on clickhouse01
-#    """
-#    FOOBAR INCORRECT REQUEST;
-#    """
-#    And we execute query on clickhouse01
-#    """
-#    FOOBAR INCORRECT REQUEST;
-#    """
-#    And we sleep for 5 seconds
-#    And we execute command on clickhouse01
-#    """
-#    ch-monitoring log-errors -n 20
-#    """
-#    Then we get response
-#    """
-#    1;10 errors for last 20 seconds
-#    """
-#    When we sleep for 30 seconds
-#    And we execute command on clickhouse01
-#    """
-#    ch-monitoring log-errors -n 20
-#    """
-#    Then we get response
-#    """
-#    0;OK, 0 errors for last 20 seconds
-#    """
-#
-#  Scenario: Check Log errors with timetail stderr output
-#    When we execute command on clickhouse01
-#    """
-#    echo 2000.01.01 00:00:00 test line > /tmp/test.log
-#    for j in {1..2000}; do echo junk line >> /tmp/test.log; done
-#    ch-monitoring log-errors -n 20 -f /tmp/test.log
-#    """
-#    Then we get response
-#    """
-#    0;OK, 0 errors for last 20 seconds
-#    """
+  Scenario: Check Log errors
+    When we sleep for 20 seconds
+    And we execute command on clickhouse01
+    """
+    ch-monitoring log-errors -n 10
+    """
+    Then we get response
+    """
+    0;OK, 0 errors for last 10 seconds
+    """
+    When we execute query on clickhouse01
+    """
+    SELECT 1;
+    """
+    And we sleep for 5 seconds
+    And we execute command on clickhouse01
+    """
+    ch-monitoring log-errors -n 20
+    """
+    Then we get response
+    """
+    0;OK, 0 errors for last 20 seconds
+    """
+    When we execute query on clickhouse01
+    """
+    FOOBAR INCORRECT REQUEST;
+    """
+    And we sleep for 5 seconds
+    And we execute command on clickhouse01
+    """
+    ch-monitoring log-errors -n 20
+    """
+    Then we get response
+    """
+    0;OK, 2 errors for last 20 seconds
+    """
+    When we execute query on clickhouse01
+    """
+    FOOBAR INCORRECT REQUEST;
+    """
+    And we execute query on clickhouse01
+    """
+    FOOBAR INCORRECT REQUEST;
+    """
+    And we execute query on clickhouse01
+    """
+    FOOBAR INCORRECT REQUEST;
+    """
+    And we execute query on clickhouse01
+    """
+    FOOBAR INCORRECT REQUEST;
+    """
+    And we sleep for 5 seconds
+    And we execute command on clickhouse01
+    """
+    ch-monitoring log-errors -n 20
+    """
+    Then we get response
+    """
+    1;10 errors for last 20 seconds
+    """
+    When we sleep for 21 seconds
+    And we execute command on clickhouse01
+    """
+    ch-monitoring log-errors -n 20
+    """
+    Then we get response
+    """
+    0;OK, 0 errors for last 20 seconds
+    """
+
+  Scenario: Check Log errors with some random test log
+    When we execute command on clickhouse01
+    """
+    echo 2000.01.01 00:00:00 test line > /tmp/test.log
+    for j in {1..2000}; do echo junk line >> /tmp/test.log; done
+    ch-monitoring log-errors -n 20 -f /tmp/test.log
+    """
+    Then we get response
+    """
+    0;OK, 0 errors for last 20 seconds
+    """
 
   Scenario: Check Ping
     When we execute command on clickhouse01