anchor.diff:    type parser
     key_name message
     
  -  format /^(?<time>[^ ]*\s*[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?[^\:]*\: *:(?<environment>.*)::(?<application>[a-zA-Z0-9_\/\.\-]*)::(?<operation>.*):\s(?<message>.*)$/
  +  format /^(?<time>[^ ]*\s*[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?[^\:]*\: *:(?<environment>.*)::(?<application>[a-zA-Z0-9_\/\.\-]*)::(?<operation>.*?):\s(?<message>.*)$/
     add_prefix processed
   </match>
   
  
positive.code:   type parser
    key_name message
  
    format /^(?<time>[^ ]*\s*[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?[^\:]*\: *:(?<environment>.*)::(?<application>[a-zA-Z0-9_\/\.\-]*)::(?<operation>.*):\s<frm><mac>(?<mac>[0-9]*)</mac><devid>(?<devid>.*)</devid>(?<message>.*)</frm>$/
    add_prefix processed
  </match>
  
  
negative.code:   type parser
    key_name message
    
    format /^(?<time>[^ ]*\s*[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?[^\:]*\: *:(?<environment>.*)::(?<application>[a-zA-Z0-9_\/\.\-]*)::(?<operation>.*?):\s(?<message>.*)$/
    add_prefix processed
  </match>
  
  