This can be done with the simple event correlator and a configuration file along the lines of
action=pipe '%s' /usr/bin/mail -s 'SOMETHING.COM' email@example.com
sec told to use the file containing the above against the file that the log appears in (this will vary depending on how
sec is installed, whether there's a vendor package, etc).
window is rather important unless you like dealing with hundreds or thousands of email messages for each and every log line matched;
sec has other means of rolling up or summarizing results; see the documentation.