vardef basic_time = '[[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2}'
vardef time = '\<' + $basic_time + '\>'
vardef ip = '[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\>'
vardef non_empty = '[^[:blank:]]+'
state date start '^[[:alpha:]]{3}[[:blank:]]{1,2}[[:digit:]]{1,2}(?=[[:blank:]]' + $basic_time + ')' begin
 state time start $time begin
 state symbol start $non_empty begin
 normal = ":" exitall
 function = '[^:\(\[]+'
 number delim "[" "]"
 number delim "(" ")"
 end
 end
end
state ip start '^' + $ip begin
 string = '[[:alnum:]]+(?=[[:blank:]]\[[[:digit:]]{2}/[[:alpha:]]{3}/[[:digit:]]{4})'
 date = '[[:digit:]]{2}/[[:alpha:]]{3}/[[:digit:]]{4}(?=:' + $basic_time + ')'
 time = $basic_time + '[[:blank:]][+-][[:digit:]]{4}'
 twonumbers = '[1-5][[:digit:]]{2}[[:blank:]][-0-9]+'
 state webmethod = "OPTIONS|GET|HEAD|POST|PUT|DELETE|TRACE|CONNECT|PROPFIND|MKCOL|COPY|MOVE|LOCK|UNLOCK" begin
 string = $non_empty exit
 end
end
vardef weekday_date = '\[[[:alpha:]]{3}[[:blank:]][[:alpha:]]{3}[[:blank:]]{1,2}[[:digit:]]{1,2}[[:blank:]](?=' + $basic_time + ')'
state date start '^' + $weekday_date begin
 time = $time
 date = '[[:digit:]]{4}\]'
 date = $weekday_date
 string = "[error]"
 comment = "[notice]"
 ip = $ip
end
ip = $ip
string = "root","failure"
(normal,port) = `((?:port|pid)[[:blank:]])([[:digit:]]+)`
state normal start '[[:blank:]](?=(IN|OUT)=)' begin
 state normal = '(IN|OUT|PROTO)=(?=[^[:blank:]]+)' begin
 string = $non_empty exit
 end
 state normal = '(SPT|DPT|TYPE|SEQ)=(?=[^[:blank:]]+)' begin
 cbracket = $non_empty exit
 end
 number = "CWR|ECE|URG|ACK|PSH|RST|SYN|FIN"
 ip = $ip
end