[MODEL: dataset="nginx_nginx_raw"]
filter _raw_log ~= "GET|HEAD|POST|DELETE|CONNECT|OPTIONS|TRACE|PATCH"
| alter 
    Source_Ip = arrayindex(regextract(_raw_log, "(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s)"),0),
    requested_line = arrayindex(regextract(_raw_log,"\"[A-Z]+\s(\S+)\sHTTP"),0),
    User_agent = arrayindex(regextract(_raw_log,"\"\s\"([^\"]+)"),0),
    bytes_size = arrayindex(regextract(_raw_log,"\d\s(\d+)"),0),
    httpmethod=arrayindex(regextract(_raw_log,"\"([A-Z]+)\s\S+\sHTTP"),0),
    statuscode=arrayindex(regextract(_raw_log,"HTTP\/\d+\.\d+\"\s(\d+)\s"),0),
// extract source_ip
    sourceipv4 = arrayindex(regextract(_raw_log, "(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s)"),0),
    sourceipv6 = arrayindex(regextract(_raw_log,"(\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+)"),0)
| alter sourceip = coalesce(sourceipv4,sourceipv6),
// end extract source_ip
    Username = arrayindex(regextract(_raw_log,"(\S+)\s\[\d+\/"),0)
| alter
    xdm.network.http.url = requested_line,
    xdm.target.sent_bytes = to_number(bytes_size),
    xdm.source.ipv4 = source_ip,
    xdm.network.http.method=httpmethod,
    xdm.network.http.response_code=statuscode,
    xdm.source.user.username = Username;
filter _raw_log !~= "GET|HEAD|POST|DELETE|CONNECT|OPTIONS|TRACE|PATCH"
| alter log_level = arrayindex(regextract(_raw_log,"\[(\w+)\]"),0),
    Tid = arrayindex(regextract(_raw_log,"\#(\d+)"),0),
    cid = arrayindex(regextract(_raw_log,"\*(\d+)"),0),
    uri = arrayindex(regextract(_raw_log,"open\(\)\s\"?([^\s]+)"),0),
    error_message = arrayindex(regextract(_raw_log,"\*\d+\s([^\,]+)"),0),
// extract client
    client_address_ipv4 = arrayindex(regextract(_raw_log,"client:\s(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"), 0),
    client_address_ipv6 = arrayindex(regextract(_raw_log,"client\:\s(\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+)"),0)
| alter client_address = coalesce(client_address_ipv4, client_address_ipv6),
// end extract client
    Server = arrayindex(regextract(_raw_log,"server\:([^\,]+)"),0),
    Request = arrayindex(regextract(_raw_log,"request\:([^\,]+)"),0),
    Host = arrayindex(regextract(_raw_log,"host\:\s\"?([^\"?\:]+)"),0),
    Referrer = arrayindex(regextract(_raw_log,"referrer\:\s([^\s]+) "),0),
    destination_port = arrayindex(regextract(_raw_log,"host\:\s\"?[^\"?\:]+\:(\d+)"),0)
| alter
    // xdm.alert.description = request
    // xdm.target.user.username = host
    xdm.alert.severity = log_level,
    xdm.target.user.identifier = tid,
    xdm.source.ipv4 = client_address,
    xdm.alert.description = error_message,
    xdm.target.user.username = server,
    xdm.event.description = referrer,
    xdm.source.user.identifier = uri,
    xdm.target.resource.value = destination_port;