anchor.diff:     : NUMBER
      ;
   
  -ip
  +
  +IP
      : NUMBER '.' NUMBER '.' NUMBER '.' NUMBER
      ;
   
   
   STRING
  -   : [a-zA-Z:/();] [a-zA-Z0-9_:/();]*
  +   : [a-zA-Z();.] [a-zA-Z0-9_();.]*
      ;
   
   
  
positive.code:    ;
  
  line
     : host logname username datetime request statuscode bytes (referer useragent)?
     ;
  
  host
     : STRING
     | ip
     ;
  
  logname
  
negative.code:    | '-'
     ;
  
  datetimetz
     : '[' date ':' time tz ']'
     ;
  
  date
     : NUMBER '/' STRING '/' NUMBER
     ;
  
  time
     : NUMBER ':' NUMBER ':' NUMBER
     ;
  
  tz
     : '-' NUMBER
     ;
  
  referer
     : literal
     ;
  
  request
     : literal
     ;
  
  useragent
     : literal
     ;
  
  literal
     : '"' ~ '"'* '"'
     ;
  
  statuscode
  