# Copyright (c) 2010 Flowerfire, Inc.  All Rights Reserved.
microsoft_share_point = {

  plugin_version = "1.0"

  # 2008-10-28 - 1.0 - KBB/MSG - Initial creation.

  # The name of the log format
  log.format.format_label = "Microsoft Office SharePoint Server Log Format"
  log.miscellaneous.log_data_type = "generic"  
  log.miscellaneous.log_format_type = "application"

  # The log is in this format if any of the first ten lines match this regular expression
  log.format.autodetect_expression = `matches_regular_expression(volatile.log_data_line, '^Timestamp              	Process                                 	TID   	Area                          	Category                      	EventID	Level     	Message 	Correlation$') or
  matches_regular_expression(volatile.log_data_line, '^SharePoint Portal Server      	')`

  #10/28/2008 11:17:10.74 	OWSTIMER.EXE (0x0648)                   	0x07D0	SharePoint Portal Server      	Business Data                 	79bv	High    	Initiating BDC Cache Invalidation Check in AppDomain 'DefaultDomain' 	 
  log.format.parsing_regular_expression = "^([0-9/]+) ([0-9:]+)\\.[0-9]+ *	([^	]+) \\(([0-9a-fA-FxX]+)\\)  *	([^	]+[^ ])? *	([^	]+[^ ])? *	([^	]+[^ ])? *	([^	]+[^ ])? *	([^	]+[^ ])? *	([^	]+[^ ])? *	([^	]+[^ ]| )$"

  # The format of dates and times in this log
  log.format.date_format = "auto"
  log.format.time_format = "auto"

  log.fields = {

    date = ""
    time = ""
    process = ""
    tid = ""
    pid = ""
    area = ""
    category = ""
    eventid = ""
    level = ""
    message = ""
    correlation = ""

  } # log.fields

  #log.parsing_filters.parse = ``

  log.filters = {

    mark_entry = {
      label = '$lang_admin.log_filters.mark_entry_label'
      comment = '$lang_admin.log_filters.mark_entry_comment'
      value = 'events = 1;'
    } # mark_entry

  } # log.filters

  database.fields = {

    date_time = ""
    hour_of_day = ""
    day_of_week = ""
    process = ""
    tid = ""
    pid = ""
    area = ""
    category = ""
    eventid = ""
    level = ""
    message = ""
    correlation = ""

  } # database.fields 

  database.numerical_fields = {

    events = {
      default = true
      requires_log_field = false
    }

  } # database.numerical_fields

  create_profile_wizard_options = {

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
    } # report_groups

  } # create_profile_wizard_options

} # microsoft_share_point