Another note - when you use two different event types/groups in the correlation rule, it's trying to correlate them WITH each other - looking for one of one and one of another. Best bet is to use the same type of event unless that's what you meant - everything "left of dot" should likely be the same event type/group.
So, I think that fix will fix it, too.