ALB_URI (%{WORD:protocol})?(://)?(%{IPORHOST:domain})?(:)?(%{INT:http_port})?(%{GREEDYDATA:request_uri})?
ALB_HTTP_REQUEST_WITH_GENERAL_URI (%{NOTSPACE:http_method})? (%{NOTSPACE:http_uri})? (%{NOTSPACE:http_version})?
ALB_HTTP_REQUEST (%{NOTSPACE:http_method})? (%{ALB_URI})? (%{NOTSPACE:http_version})?
BASE_ALB_ACCESS_LOG_GENERAL_URI %{DATA:type}\s%{TIMESTAMP_ISO8601:time}\s%{DATA:elb}\s%{DATA:client}\s%{DATA:target}\s%{BASE10NUM:request_processing_time}\s%{DATA:target_processing_time}\s%{BASE10NUM:response_processing_time}\s%{BASE10NUM:elb_status_code}\s%{DATA:target_status_code}\s(?:-|%{BASE10NUM:received_bytes:int})\s(?:-|%{BASE10NUM:sent_bytes:int})\s\"%{ALB_HTTP_REQUEST_WITH_GENERAL_URI}\"\s\"%{DATA:user_agent}\"\s%{DATA:ssl_cipher}\s%{DATA:ssl_protocol}\s%{DATA:target_group_arn}\s\"%{DATA:trace_id}\"
BASE_ALB_ACCESS_LOG %{DATA:type}\s%{TIMESTAMP_ISO8601:time}\s%{DATA:elb}\s%{DATA:client}\s%{DATA:target}\s%{BASE10NUM:request_processing_time}\s%{DATA:target_processing_time}\s%{BASE10NUM:response_processing_time}\s%{BASE10NUM:elb_status_code}\s%{DATA:target_status_code}\s(?:-|%{BASE10NUM:received_bytes:int})\s(?:-|%{BASE10NUM:sent_bytes:int})\s\"%{ALB_HTTP_REQUEST}\"\s\"%{DATA:user_agent}\"\s%{DATA:ssl_cipher}\s%{DATA:ssl_protocol}\s%{DATA:target_group_arn}\s\"%{DATA:trace_id}\"
ALB_ACCESS_LOG_GENERAL_URI %{BASE_ALB_ACCESS_LOG_GENERAL_URI}\s\"(?:-|%{DATA:domain_name})\"\s\"(?:-|%{DATA:chosen_cert_arn})\"\s(?:-|%{INT:matched_rule_priority:int})\s%{TIMESTAMP_ISO8601:request_creation_time}\s\"(?:-|%{DATA:actions_executed})\"\s\"(?:-|%{DATA:redirect_url})\"\s\"(?:-|%{DATA:error_reason})\"\s\"(?:-|%{DATA:target_list})\"\s\"(?:-|%{DATA:target_status_code_list})\"\s\"(?:-|%{DATA:classification})\"\s\"(?:-|%{DATA:classification_reason})\"
ALB_ACCESS_LOG %{BASE_ALB_ACCESS_LOG}\s\"(?:-|%{DATA:domain_name})\"\s\"(?:-|%{DATA:chosen_cert_arn})\"\s(?:-|%{INT:matched_rule_priority:int})\s%{TIMESTAMP_ISO8601:request_creation_time}\s\"(?:-|%{DATA:actions_executed})\"\s\"(?:-|%{DATA:redirect_url})\"\s\"(?:-|%{DATA:error_reason})\"\s\"(?:-|%{DATA:target_list})\"\s\"(?:-|%{DATA:target_status_code_list})\"\s\"(?:-|%{DATA:classification})\"\s\"(?:-|%{DATA:classification_reason})\"

ELB_URIPATHPARAM %{URIPATH:path}(?:%{URIPARAM:params})?
ELB_URI %{URIPROTO:proto}://(?:%{USER}(?::[^@]*)?@)?(?:%{URIHOST:urihost})?(?:%{ELB_URIPATHPARAM})?
ELB_REQUEST_LINE (?:%{WORD:verb} %{ELB_URI:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})
ELB_ACCESS_LOG %{TIMESTAMP_ISO8601:timestamp}\s%{NOTSPACE:elb}\s%{IP:clientip}:%{INT:clientport:int}\s(?:-|(?:%{IP:backendip}:?:%{INT:backendport:int}))\s(?:-|%{NUMBER:request_processing_time:float})\s(?:-|%{NUMBER:backend_processing_time:float})\s(?:-|%{NUMBER:response_processing_time:float})\s(?:-|%{INT:response:int})\s(?:-|%{INT:backend_response:int})\s(?:-|%{INT:received_bytes:int})\s(?:-|%{INT:bytes:int})\s\"%{ELB_REQUEST_LINE}\"

S3_HTTP_REQUEST ((?:%{WORD:verb}\s%{NOTSPACE:request}\s(?:HTTP/%{NUMBER:httpversion}))?|%{DATA:rawrequest})
S3_ACCESS_LOG %{WORD:owner}\s%{NOTSPACE:bucket}\s\[%{HTTPDATE:timestamp}\]\s%{IP:clientip}\s%{NOTSPACE:requester}\s%{NOTSPACE:request_id}\s%{NOTSPACE:operation}\s%{NOTSPACE:key}\s(?:-|"%{S3_HTTP_REQUEST}")\s(?:-|%{INT:response:int})\s(?:-|%{NOTSPACE:error_code})\s(?:-|%{INT:bytes_sent:int})\s(?:-|%{INT:object_size:int})\s(?:-|%{INT:request_time_ms:int})\s(?:-|%{INT:turnaround_time_ms:int})\s(?:%{QS:referrer})\s(?:-|"?%{QS:agent}"?)\s(?:-|%{NOTSPACE:version_id})

CLOUDFRONT_ACCESS_LOG (?<timestamp>%{YEAR}-%{MONTHNUM}-%{MONTHDAY}\s%{TIME})\s%{NOTSPACE:x_edge_location}\s(?:-|%{NUMBER:sc_bytes:int})\s%{IPORHOST:clientip}\s%{WORD:cs_method}\s%{HOSTNAME:cs_host}\s%{NOTSPACE:cs_uri_stem}\s(?:-|%{NUMBER:sc_status:int})\s%{GREEDYDATA:referrer}\s%{GREEDYDATA:agent}\s%{GREEDYDATA:cs_uri_query}\s%{GREEDYDATA:cookies}\s%{WORD:x_edge_result_type}\s%{NOTSPACE:x_edge_request_id}\s%{HOSTNAME:x_host_header}\s%{URIPROTO:cs_protocol}\s(?:-|%{INT:cs_bytes:int})\s(?:-|%{GREEDYDATA:time_taken:float}\s%{GREEDYDATA:x_forwarded_for}\s%{GREEDYDATA:ssl_protocol}\s%{GREEDYDATA:ssl_cipher}\s%{GREEDYDATA:x_edge_response_result_type}

VPC_FLOW_LOG %{NUMBER:version}\s%{NUMBER:account-id}\s%{NOTSPACE:interface-id}\s%{NOTSPACE:srcaddr}\s%{NOTSPACE:dstaddr}\s(?:-|%{NOTSPACE:srcport:int})\s(?:-|%{NOTSPACE:dstport:int})\s(?:-|%{NOTSPACE:protocol:int})\s(?:-|%{NOTSPACE:packets:int})\s(?:-|%{NOTSPACE:bytes:int})\s(?:-|%{NUMBER:start:int})\s(?:-|%{NUMBER:end:int})\s%{NOTSPACE:action}\s%{NOTSPACE:log-status}