# Copyright (c) 2010 Flowerfire, Inc.  All Rights Reserved.
windows_event_log_dumpeventlogs_vbs = {

  plugin_version = "1.0"

  # 2014-10-13 - Initial creation (forked from existing)


  info.1.manufacturer = "Microsoft"
  info.1.device = "Windows Event Log (dumpeventlogs.vbs export)"
  info.1.version.1 = ""

  # sessions, hits, bandwidth, pageviews, and visitors.

  # The name of the log format
  log.format.format_label = "Windows Event Log (dumpeventlogs.vbs export)"
  log.miscellaneous.log_data_type = "csv"  
  log.miscellaneous.log_format_type = "other"

  # The log is in this format if any of the first ten lines match this regular expression
  log.format.autodetect_regular_expression = `^[^,]+,[0-9]+/[0-9]+/[0-9]+,[0-9]+:[0-9][0-9]:[0-9][0-9] (AM|PM),[^,]+`

  # This regular expression is used to parse the log fields out of the log entry
  log.format.parsing_regular_expression = `^([^,]+),([0-9]+/[0-9]+/[0-9]+),([0-9]+:[0-9][0-9]:[0-9][0-9] [APM]+),[^,]+,([^,]+),([^,]+),([^,]+),([^,]+),([^,]+),([^,]+),([^,]+),(.*)`

  # The format of dates and times in this log
  log.format.date_format = "m/d/yyyy"
  log.format.time_format = "h:mm:ss AM/PM"

  # There can be newlines inside quotes in CSV files-- let them field values across lines
  log.format.allow_newlines_inside_quotes = "true"

  log.format.ignore_format_lines = "true"

  # Log fields
  log.fields = {

	machinename = ""
    date = ""
	time = ""
	
	#record_number = "" # not useful
	log = ""
    user = ""
    event_id = ""
    type = ""
		event_code = ""
    category = ""
    result = ""
    description = ""
		logon_type = ""

  } # log.fields


  # Database fields
  database.fields = {

    date_time = ""
    day_of_week = ""
    hour_of_day = ""
    machinename = ""
	
	# record_number = "" 
		log = ""
    user = ""
    event_id = ""
    type = ""
		event_code = ""
    category = ""
    result = ""
    description = ""
		logon_type = ""

  } # database.fields

  
  database.numerical_fields = {

    events = {
      label = "$lang_stats.field_labels.events"
      default = true
      requires_log_field = false
      type = "int"
      display_format_type = "integer"
      entries_field = true
    } # events

  } # database.numerical_fields


  log.filters = {
		logon_type = {
			label = 'Logon Type'
			comment = 'This extracts the logon type from the description field where present'
			value = `if (matches_regular_expression(description, 'Logon Type:[^0-9]+([0-9]+)')) then logon_type = $1;`
		}

    simplify_description = {
      label = '$lang_admin.log_filters.simplify_description_label'
      comment = '$lang_admin.log_filters.simplify_description_comment'
      value = 'description = "[simplified]"'
	  	disabled = true
    } # simplify_description

    mark_entry = {
      label = '$lang_admin.log_filters.mark_entry_label'
      comment = '$lang_admin.log_filters.mark_entry_comment'
      value = 'events = 1;'
    } # mark_entry

  } # log.filters

  create_profile_wizard_options = {

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
    } # report_groups

  } # create_profile_wizard_options

} # windows_event_log_dumpeventlogs_vbs