anchor.diff:  	{_, _, diameter, _, _, event, #'3gpp_ro_CCR'{}, #'3gpp_ro_CCA'{}, [#rated{} = Rated | _]} = E1,
   	#rated{bucket_value = _RatedValue, bucket_type = messages, is_billed = true,
   			product = OfferId, price_type = usage} = Rated.
  +
  +dia_auth_to_ecs() ->
  +	[{userdata, [{doc, "Convert diameter ocs_auth log to ECS"}]}].
  +
  +dia_auth_to_ecs(_Config) ->
  +	Protocol = diameter,
  +	Node = node(),
  +	ServerAddress = {0, 0, 0, 0},
  +	ServerPort = 3668,
  +	ClientAddress = {86,12,5,8},
  +	ClientPort = 5053,
  +	Server = {ServerAddress, ServerPort},
  +	Client = {ClientAddress, ClientPort},
  +	SessionID = diameter:session_id("ackjd713eedhc"),
  +	OH = "client.testdomain.com",
  +	OR = "testdomain.com",
  +	DR = "sigscale.com",
  +	AuthType = ?'DIAMETER_NAS_APP_AUTH-REQUEST-TYPE_AUTHENTICATE_ONLY',
  +	ResultCode = ?'DIAMETER_BASE_RESULT-CODE_SUCCESS',
  +	MSISDN = list_to_binary(ocs:generate_identity()),
  +	Request = #diameter_nas_app_AAR{'Session-Id' = SessionID,
  +			'Auth-Application-Id' = 1, 'Origin-Host' = OH,
  +			'Origin-Realm' = OR, 'Destination-Realm' = DR,
  +			'Auth-Request-Type' = AuthType, 'User-Name' = MSISDN},
  +	Response = #diameter_nas_app_AAA{'Session-Id' = SessionID,
  +			'Auth-Application-Id' = 1, 'Auth-Request-Type' = AuthType,
  +			'Result-Code' = ResultCode, 'Origin-Host' = OH,
  +			'Origin-Realm' = OR},
  +	TS = erlang:system_time(millisecond),
  +	N = erlang:unique_integer([positive]),
  +	Node = node(),
  +	Protocol = diameter,
  +	LogEvent = {TS, N, Protocol, Node, Server, Client, Request, Response},
  +	{struct, EcsObj} = ocs_log:auth_to_ecs(LogEvent),
  +	TimeStamp = ocs_log:iso8601(TS),
  +	{_, TimeStamp} = lists:keyfind("@timestamp", 1, EcsObj),
  +	{_, {struct, EventObj}} = lists:keyfind("event", 1, EcsObj),
  +	EventId = integer_to_list(TS) ++ "-" ++ integer_to_list(N),
  +	{_, EventId} = lists:keyfind("id", 1, EventObj),
  +	Url = "http://host.example.net:8080" ++ ?usagePath ++ EventId,
  +	{_, Url} = lists:keyfind("url", 1, EventObj),
  +	{_, "start"} = lists:keyfind("type", 1, EventObj),
  +	{_, "success"} = lists:keyfind("outcome", 1, EventObj),
  +	{_, {struct, [{"port", ServerPort}]}} = lists:keyfind("server", 1, EcsObj),
  +	{_, {struct, ServiceObj}} = lists:keyfind("service", 1, EcsObj),
  +	{_, ServerAddress} = lists:keyfind("ip", 1, ServiceObj),
  +	{_, {struct, [{_, Node}]}} = lists:keyfind("node", 1, ServiceObj),
  +	{_, {struct, NetworkObj}} = lists:keyfind("network", 1, EcsObj),
  +	{_, "nas"} = lists:keyfind("application", 1, NetworkObj),
  +	{_, Protocol} = lists:keyfind("protocol", 1, NetworkObj),
  +	{_, {struct, ClientObj}} = lists:keyfind("client", 1, EcsObj),
  +	{_, OH} = lists:keyfind("address", 1, ClientObj),
  +	{_, ClientAddress} = lists:keyfind("ip", 1, ClientObj),
  +	{_, OH} = lists:keyfind("domain", 1, ClientObj),
  +	{_, OR} = lists:keyfind("subdomain", 1, ClientObj),
  +	{_, {struct, [{"subdomain", DR}]}} = lists:keyfind("destination", 1, EcsObj),
  +	{_, {struct, SourceObj}} = lists:keyfind("source", 1, EcsObj),
  +	{_, {struct, [{"name", MSISDN}]}} = lists:keyfind("user", 1, SourceObj).
   
   %%---------------------------------------------------------------------
   %% internal functions
  
positive.code: 			binary_tree_after, binary_tree_backward, binary_tree_forward,
  			binary_tree_last, binary_tree_first, binary_tree_half,
  			diameter_scur, diameter_scur_voice, diameter_ecur,
  			diameter_iec].
  
  %%---------------------------------------------------------------------
  %%  Test cases
  
negative.code: -define(RO_APPLICATION_ID, 4).
  -define(IANA_PEN_3GPP, 10415).
  -define(IANA_PEN_SigScale, 50386).
  
  -define(usagePath, "/usageManagement/v1/usage/").
  
  %%---------------------------------------------------------------------
  %%  Test server callback functions
  