# Copyright (c) 2010 Flowerfire, Inc.  All Rights Reserved.
windows_event_log_logparser_csv = {

  # The name of the log format
  log.format.format_label = "Windows XP Event Log (Microsoft LogParser CSV Export)"
  log.miscellaneous.log_data_type = "generic"  
  log.miscellaneous.log_format_type = "other"

  # The log is in this format if any of the first ten lines match this regular expression
  log.format.autodetect_expression = "volatile.log_data_line eq 'EventLog,RecordNumber,TimeGenerated,TimeWritten,EventID,EventType,EventTypeName,EventCategory,EventCategoryName,SourceName,Strings,ComputerName,SID,Message,Data'"

#  log.format.ignore_format_lines = "true"
  log.format.allow_newlines_inside_quotes = "true"
#  log.format.parse_only_with_filters = "true"
  log.format.field_separator = ","

  # This regular expression is used to parse the log fields out of the log entry
#  log.format.parsing_regular_expression = "^([0-9]+[/-][0-9]+[/-][0-9][0-9][0-9][0-9]),([0-9]+:[0-9][0-9]:[0-9][0-9][^,]*),([^,]*),([^,]*),([^,]*),([0-9]*),([^,]*),([^,]*),\"*(.*)\"*$"

#  auto_setup.omit_database_fields = "recordnumber,timewritten"

  # The format of dates and times in this log
  log.format.date_format = "auto"
  log.format.time_format = "auto"

  # Log fields
  log.fields = {

    eventlog.index = "1"
    recordnumber.index = "2"
    date = ""
    time = ""
    timegenerated.index = "3"
    timewritten.index = "4"
    eventid.index = "5"
    eventtype.index = "6"
    eventtypename.index = "7"
    eventcategory.index = "8"
    eventcategoryname.index = "9"
    sourcename.index = "10"
    strings.index = "11"
    computername.index = "12"
    sid.index = "13"
    message.index = "14"
    data.index = "15"

  } # log.fields

  log.parsing_filters = {

    # Parse out the date/time
    parse = "
if (matches_regular_expression(timegenerated, '^([0-9-]+) ([0-9:]+)$')) then (
  date = $1;
  time = $2;
);
"

  } # parsing_filters

  # Database fields
  database.fields = {

    eventlog = ""
#    recordnumber = ""
    date_time = ""
    hour_of_day = ""
    day_of_week = ""
    eventid = ""
    eventtype = ""
    eventtypename = ""
    eventcategory = ""
    eventcategoryname = ""
    sourcename = ""
    strings = ""
    computername = ""
    sid = ""
    message = ""
    data = ""

  } # database.fields

  database.numerical_fields = {

    events = {
      label = "$lang_stats.field_labels.events"
      default = true
      requires_log_field = false
      type = "int"
      display_format_type = "integer"
      entries_field = true
    } # events

  } # database.numerical_fields

  log.filters = {

    mark_entry = {
      label = '$lang_admin.log_filters.mark_entry_label'
      comment = '$lang_admin.log_filters.mark_entry_comment'
      value = 'events = 1;'
    } # mark_entry

  } # log.filters

  create_profile_wizard_options = {
    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
    } # report_groups
  } # create_profile_wizard_options
} # windows_event_log_logparser_csv