[MODEL: dataset = msft_ecm_raw]
alter
    thread_id = arrayindex(regextract(_raw_log, "thread\=\"*(\d+)\"*"), 0),
    file = arrayindex(regextract(_raw_log, "file\=\"([^\"]*)\""), 0),
    msg_1 = arrayindex(regextract(_raw_log, "^(.+)[\~|\$]"), 0),
    msg_2 = arrayindex(regextract(_raw_log, "^\<\!\[LOG\[(.+)\]LOG"), 0),
    component = arrayindex(regextract(_raw_log, "component\=\"(\S+)\""), 0),
    component2 = arrayindex(regextract(_raw_log, "\<(SMS\S+)\>"), 0),
    ipV4 = arrayindex(regextract(_raw_log, "\b(?:\d{1,3}\.){3}\d{1,3}\b"), 0),
    filename = arrayindex(regextract(_raw_log ,"Processing\sfile\s(\S+)\s"),0),
    path = arrayindex(regextract(_raw_log ,"path\s*[\:|\=]\s*\'([^\']+)\'"),0),
    dns_name = arrayindex(regextract(_raw_log ,"DNS\sname\s\=\s\'([^\']+)\'"),0),
    site_server = arrayindex(regextract(_raw_log , "SiteServer\=([^\,]+)\,"),0),
    duration1 = arrayindex(regextract(_raw_log ,"\s(\d*\.*\d+)\sseconds"),0),
    duration2 = arrayindex(regextract(_raw_log ,"\s(\d*\.*\d+)\shours"),0),
    duration3 = arrayindex(regextract(_raw_log ,"\s(\d+)\sminutes"),0),
    log_prefix = lowercase(arrayindex(regextract(_raw_log ,"^([A-Za-z]*\s*[a-zA-Z]*)\>*\:"),0)),
    event_type = arrayindex(regextract(_log_source_file_name, "([\w_]+)[-\d+]{0,}\.log"),0),
    user_name_1 = arrayindex(regextract(_raw_log, "\[?UserName\]?=\[?([^~\s\[\]]+)"), 0),
    user_name_2 = arrayindex(regextract(_raw_log, "User=([^~\s]+)"), 0),
    user_name_3 = arrayindex(regextract(_raw_log, "User Context:\s+([^~\s]+)"), 0),
    user_name_4 = arrayindex(regextract(_raw_log, "User -\s+\[([^~\s\]]+)"), 0),
    user_name_5 = arrayindex(regextract(_raw_log, "user name \[([^~\s\]]+)"), 0),
    user_name_6 = arrayindex(regextract(_raw_log, "\[User ([^~\s]+)"), 0),
    user_domain = arrayindex(regextract(_raw_log, "UserName=([^\\]+)\\"), 0)
| alter
        user_name = coalesce(user_name_1, user_name_2, user_name_3, user_name_4, user_name_5, user_name_6)
| alter
    duration = coalesce(duration1 , duration2, duration3),
    component = coalesce(component, component2),
    msg = coalesce(msg_1, msg_2),
    event_type = if(event_type contains "CMGService", "CMGService", event_type contains "SMSPXE", "SMSPXE", event_type),
    user_name = if(user_name contains """\\""", arrayindex(regextract(user_name, "\\([\S]+)"), 0), user_name)
| alter
    xdm.session_context_id = thread_id,
    xdm.event.description = msg,
    xdm.event.operation = component,
    xdm.source.ipv4 = ipV4,
    xdm.target.file.filename = coalesce(filename,file),
    xdm.target.file.path = path,
    xdm.network.dns.dns_resource_record.name = dns_name,
    xdm.observer.name = site_server,
    xdm.event.duration = to_number(duration),
    xdm.event.type = event_type,
    xdm.event.log_level = if(log_prefix contains "info", XDM_CONST.LOG_LEVEL_INFORMATIONAL, log_prefix contains "debug", XDM_CONST.LOG_LEVEL_DEBUG, log_prefix contains "alert", XDM_CONST.LOG_LEVEL_ALERT, log_prefix contains "crit", XDM_CONST.LOG_LEVEL_CRITICAL, log_prefix contains "error", XDM_CONST.LOG_LEVEL_ERROR, log_prefix contains "warn", XDM_CONST.LOG_LEVEL_WARNING, log_prefix contains "notice", XDM_CONST.LOG_LEVEL_NOTICE, to_string(log_prefix)),
    xdm.source.user.domain = user_domain,
    xdm.source.user.username = user_name;