beta_watchguard_xml = {

  # Plugin Version info
  # 1.0Beta - new plugin
  # 1.1Beta - added FWStatus amd WGLog to the auto-detect regex
  plugin_version = "1.1Beta"

  # The name of the log format
  log.format.format_label = "Watchguard XML Log Format"
  log.miscellaneous.log_data_type = "firewall"
  log.miscellaneous.log_format_type = "firewall"


  # The log is in this format if any of the first ten lines match this regular expression
  log.format.autodetect_regular_expression = `^<(ProxyHTPReq|ProxyMatch|FWAllow|FWDeny|FWStatus|WGLog) d="[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9]:[0-9][0-9]" `

  # All log field parsing will be done using the parsing filters
  log.format.parse_only_with_filters = "true"

  # Log fields
  log.fields = {

    d.label = "watchguard date/time"
    date = ""
    time = ""
    event_type = ""
    orig = ""
    sn = ""
    tz = ""
    policy = ""
    src_ip.type = "host"
    dst_ip = ""
    pr = ""
    src_port = ""
    dst_port = ""
    type = "" 
    dir = ""
    wgt = ""
    tcp_flags = ""
    proc_id = ""
    disp = ""
    src_intf = ""
    dir = ""
    wgt = ""
    pckt_len = "" 
    ttl = ""
    ip_hdr_len = ""

    version = ""
    encoding = ""
    msg = ""
    recv = ""
    sent = ""
    source = ""
    url = {
      hierarchy_dividers = "/?"
      left_to_right = true
      leading_divider = "true"
    }
    why = ""

  } # log.fields


  #          
  # Log Parsing Filters
  log.parsing_filters.parse = `

# e.g.: <ProxyHTTPReq d="2005-09-15T16:36:46" orig="192.168.1.1" policy="HTTP" src_ip="192.168.1.26" dst_ip="192.239.90.87" pr="TCP/http" src_port="2993" dst_port="80" type="HTTP" dir="out" wgt="2018" sent="326" recv="314"/>

if (matches_regular_expression(current_log_line(), '^<([^ ]*) (.*)>$')) then (
  set_collected_field('', 'event_type', $1);
  collect_listed_fields('', $2, ' ', '=', '');
  if (matches_regular_expression(get_collected_field('', 'd'), '^([0-9-]*)T([0-9:]*)$')) then (
    set_collected_field('', 'date', $1);
    set_collected_field('', 'time', $2);
  );
  set_collected_field('', 'events', 1);
  accept_collected_entry('', false);
);
`


  # Database fields
  database.fields = {

    date_time = ""
    hour_of_day = ""
    day_of_week = ""
    event_type = ""
    orig = ""
    sn = ""
    tz = ""
    policy = ""
    src_ip = ""
    location = ""
    dst_ip = ""
    pr = ""
    src_port = ""
    dst_port = ""
    type = "" 
    dir = ""
    wgt = ""
    tcp_flags = ""
    proc_id = ""
    disp = ""
    src_intf = ""
    dir = ""
    wgt = ""
    ttl = ""
    version = ""
    encoding = ""
    msg = ""
    source = ""
    url = ""
    why = ""

  } # database.fields

  database.numerical_fields = {

    events = {
      label = "$lang_stats.field_labels.events"
      default = true
      requires_log_field = false
      type = "int"
      display_format_type = "integer"
      entries_field = true
    } # events

    recv = {
      type = "float"
      display_format_type = "bandwidth"
    }

    sent = {
      type = "float"
      display_format_type = "bandwidth"
    }

    unique_source_ips = {
      log_field = "src_ip"
      type = "unique"
    } # unique_source_ips

    pckt_len = {
      type = "float"
      display_format_type = "bandwidth"
    }

    ip_hdr_len = {
      type = "float"
      display_format_type = "bandwidth"
    }

  } # database.numerical_fields


  create_profile_wizard_options = {

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
      orig = true
      sn = true
      tz = true
      policy = true
      src_ip = true
      location = true
      dst_ip = true
      pr = true
      src_port = true
      dst_port = true
      type = true 
      dir = true
      wgt = true
      tcp_flags = true
      proc_id = true
      disp = true
      src_intf = true
      dir = true
      wgt = true
      pckt_len = true 
      ttl = true
      ip_hdr_len = true
    } # report_groups

  } # create_profile_wizard_options

} # beta_watchguard_xml