$template logpattern,"%timegenerated:1:19:date-rfc3339% %msg:F,32:3% %msg:R,ERE,1,BLANK:(IN=[a-zA-Z0-9]*)--end% %msg:R,ERE,1,BLANK:(OUT=[a-zA-Z0-9]*)--end% %msg:R,ERE,1,BLANK:(SRC=[a-zA-Z0-9\.]*)--end% %msg:R,ERE,1,BLANK:(DST=[a-zA-Z0-9\.]*)--end% %msg:R,ERE,1,BLANK:(PROTO=[a-zA-Z0-9]*)--end% %msg:R,ERE,1,BLANK:(SPT=[0-9]*)--end% %msg:R,ERE,1,BLANK:(DPT=[0-9]*)--end%\n"