neoteris = {

  # The name of the log format
  log.format.format_label = "Neoteris Log Format"
  log.miscellaneous.log_format_type = "network_device"

  #log_data_type network
  log.miscellaneous.log_data_type = "syslog_required"

  # The log is in this format if any of the first ten lines match this regular expression
  log.format.autodetect_regular_expression = "Neoteris: "

  # All log field parsing will be done using the parsing filters
  log.format.parse_only_with_filters = "true"

  # A log entry is called an event
  statistics.miscellaneous.entry_name = "events"

  # Log fields
  log.fields = {

    priority = {
      label = "$lang_stats.field_labels.priority"
      type = "flat"
      index = 0
      subindex = 0
    } # priority

    source = {
      label = "$lang_stats.field_labels.source"
      type = "flat"
      index = 0
      subindex = 0
    } # source

    user = {
      label = "$lang_stats.field_labels.user"
      type = "flat"
      index = 0
      subindex = 0
    } # user

    id_source = {
      label = "$lang_stats.field_labels.id_source"
      type = "flat"
      index = 0
      subindex = 0
    } # id_source

    group = {
      label = "$lang_stats.field_labels.group"
      type = "flat"
      index = 0
      subindex = 0
    } # group

    destination_ip = {
      label = "$lang_stats.field_labels.destination_ip"
      type = "flat"
      index = 0
      subindex = 0
    } # destination_ip

    destination_port = {
      label = "$lang_stats.field_labels.destination_port"
      type = "flat"
      index = 0
      subindex = 0
    } # destination_port

    duration = {
      label = "$lang_stats.field_labels.duration"
      type = "flat"
      index = 0
      subindex = 0
    } # duration

    bytes_read = {
      label = "$lang_stats.field_labels.bytes_read"
      type = "flat"
      index = 0
      subindex = 0
    } # bytes_read

    chunks_read = {
      label = "$lang_stats.field_labels.chunks_read"
      type = "flat"
      index = 0
      subindex = 0
    } # chunks_read

    bytes_written = {
      label = "$lang_stats.field_labels.bytes_written"
      type = "flat"
      index = 0
      subindex = 0
    } # bytes_written

    chunks_written = {
      label = "$lang_stats.field_labels.chunks_written"
      type = "flat"
      index = 0
      subindex = 0
    } # chunks_written

  } # log.fields


  #          
  # Log Parsing Filters
  log.parsing_filters = {

    # Parse out the priority, user, and group
    1 = {
      label = "1"
      comment = ""
      value = "
if (matches_regular_expression(entire_line, 'Neoteris: ([^ ]+) - ([^ ]+) - ([^-]*) - ')) then (
  set_collected_field('', 'priority', $1);
  set_collected_field('', 'source', $2);
  volatile.group = $3;
  if (matches_regular_expression(volatile.group, '^([^(]+)\\\\(([^)]+)\\\\)\\\\[([^]]+)\\\\]')) then (
    set_collected_field('', 'user', $1);
    set_collected_field('', 'id_source', $2);
    set_collected_field('', 'group', $3);
  )
  else if (matches_regular_expression(volatile.group, '^([^(]+)\\\\(([^)]+)\\\\)')) then (
    set_collected_field('', 'user', $1);
    set_collected_field('', 'id_source', $2);
  )
);
"
    } # 1

    # Parse out the Closed connection lines
    closed_connection = {
      label = "Closed connection"
      comment = ""
      value = "
if (matches_regular_expression(entire_line, 'Neoteris: [^ ]+ - [^ ]+ - [^-]+ - ([^-]+)- ([^ ]+) - Closed connection to ([^ ]+) port ([0-9]+) after ([0-9]+) seconds, with ([0-9]+) bytes read .in ([0-9]+) chunks. and ([0-9]+) bytes written .in ([0-9]+) chunks')) then (
  set_collected_field('', 'destination_ip', $6);
  set_collected_field('', 'destination_port', $7);
  set_collected_field('', 'duration', $8);
  set_collected_field('', 'bytes_read', $9);
  set_collected_field('', 'chunks_read', $10);
  set_collected_field('', 'bytes_written', $11);
  set_collected_field('', 'chunks_written', $12);
);"
    } # closed_connection

    # Accept this log entry
    accept = {
      label = "accept"
      comment = ""
      value = "accept_collected_entry_using_regexp('^()', false)"
    } # accept

  } # log.parsing_filters


  # Database fields
  database.fields = {

    priority = {
      label = "$lang_stats.field_labels.priority"
      log_field = "priority"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # priority

    source = {
      label = "$lang_stats.field_labels.source"
      log_field = "source"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # source

    user = {
      label = "$lang_stats.field_labels.user"
      log_field = "user"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # user

    id_source = {
      label = "$lang_stats.field_labels.id_source"
      log_field = "id_source"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # id_source

    group = {
      label = "$lang_stats.field_labels.group"
      log_field = "group"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # group

    destination_ip = {
      label = "$lang_stats.field_labels.destination_ip"
      log_field = "destination_ip"
      type = "string"
      suppress_top = 0
      suppress_bottom = 2
    } # destination_ip

  } # database.fields


  # Log Filters
  log.filters = {

    mark_entry = {
      label = '$lang_admin.log_filters.mark_entry_label'
      comment = '$lang_admin.log_filters.mark_entry_comment'
      value = 'events = 1;'
    } # mark_entry

  } # log.filters

  database.numerical_fields = {

    events = {
      label = "$lang_stats.field_labels.events"
      default = true
      requires_log_field = false
      type = "int"
      display_format_type = "integer"
      entries_field = true
    } # events

    unique_client_ips = {
      label = "$lang_stats.field_labels.unique_client_ips"
      default = false
      requires_log_field = true
      log_field = "source"
      type = "unique"
      display_format_type = "integer"
    } # unique_client_ips

    bytes_read = {
      label = "$lang_stats.field_labels.bytes_read"
      default = false
      requires_log_field = true
      log_field = "bytes_read"
      type = "float"
      display_format_type = "bandwidth"
    } # bytes_read

    bytes_written = {
      label = "$lang_stats.field_labels.bytes_written"
      default = false
      requires_log_field = true
      log_field = "bytes_written"
      type = "float"
      display_format_type = "bandwidth"
    } # bytes_written

    chunks_read = {
      label = "$lang_stats.field_labels.chunks_read"
      default = false
      requires_log_field = true
      log_field = "chunks_read"
      type = "int"
      display_format_type = "integer"
    } # chunks_read

    chunks_written = {
      label = "$lang_stats.field_labels.chunks_written"
      default = false
      requires_log_field = true
      log_field = "chunks_written"
      type = "int"
      display_format_type = "integer"
    } # chunks_written

    duration = {
      label = "$lang_stats.field_labels.duration"
      default = false
      requires_log_field = true
      log_field = "duration"
      type = "float"
      display_format_type = "duration_compact"
    } # duration

  } # database.numerical_fields


  create_profile_wizard_options = {
    host_tracking = true

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
      priority = true
      source = true
      id_source = true
      user = true
      group = true
      destination_ip = true
      destination_port = true
    } # report_groups

  } # create_profile_wizard_options

  not_supported = {
    sessionpages = true
    pageviews = true
  } # not_supported

} # neoteris