`*.fmt` placeholder definitions should got to They take precedence over the ones bundles in the pip packge, or the builtins in `logfmt1.rulesdb`


## apache generic

| placeholder 	 | id 	 | regex 	 	 | grok/fmt-recursion 	 | description/reference 	 |
-------------------------------------------------------------------------------------------
| %a 	 | remote_addr 	 | `[\d.:a-f]+` 	 | - 	 | |
| %{c}a 	 | remote_addr 	 | `[\d.:a-f]+` 	 | - 	 | |
| %h 	 | remote_host 	 | | - 	 | |
| %{c}h 	 | remote_host 	 | | - 	 | |
| %A 	 | local_address 	 | `[\d.:a-f]+` 	 | - 	 | |
| %u 	 | remote_user 	 | | - 	 | |
| %l 	 | remote_logname 	 | | - 	 | |
| %t 	 | request_time 	 | | - 	 | |
| %{u}t 	 | request_time 	 | | - 	 | |
| %{cu}t 	 | request_time 	 | | - 	 | |
| %{msec_frac}t 	 | msec_frac 	 | `[\d.]+` 	 | - 	 | |
| %{usec_frac}t 	 | usec_frac 	 | `[\d.]+` 	 | - 	 | |
| %f 	 | request_file 	 | `[^\s"]+` 	 | - 	 | |
| %b 	 | bytes_sent 	 | `\d+¦-` 	 | - 	 | |
| %B 	 | bytes_sent 	 | `\d+¦-` 	 | - 	 | |
| %O 	 | bytes_out 	 | `\d+` 	 | - 	 | |
| %I 	 | bytes_in 	 | `\d+` 	 | - 	 | |
| %S 	 | bytes_combined 	 | `\d+` 	 | - 	 | |
| %E 	 | apr_status 	 | `\w+` 	 | - 	 | |
| %M 	 | message 	 | `.+` 	 | - 	 | |
| %L 	 | log_id 	 | | - 	 | |
| %{c}L 	 | log_id 	 | | - 	 | |
| %{C}L 	 | log_id 	 | | - 	 | |
| %V 	 | server_name 	 | | - 	 | |
| %v 	 | virtual_host 	 | | - 	 | |
| %p 	 | server_port 	 | `\d+` 	 | - 	 | |
| %{local}p 	 | server_port 	 | `\d+` 	 | - 	 | |
| %{canonical}p 	 | canonical_port 	 | `[\w.]+` 	 | - 	 | |
| %{remote}p 	 | remote_port 	 | `\d+` 	 | - 	 | |
| %P 	 | pid 	 | `\d+` 	 | - 	 | |
| %{g}T 	 | tid 	 | `\d+` 	 | - 	 | |
| %{tid}P 	 | tid 	 | `\d+` 	 | - 	 | |
| %{pid}P 	 | pid 	 | `\d+` 	 | - 	 | |
| %{hextid}P 	 | tid 	 | `\w+` 	 | - 	 | |
| %{hexpid}P 	 | pid 	 | `\w+` 	 | - 	 | |
| %H 	 | request_protocol 	 | | - 	 | |
| %m 	 | request_method 	 | `[\w.]+` 	 | - 	 | |
| %q 	 | request_query 	 | | - 	 | |
| %F 	 | file_line 	 | | - 	 | |
| %X 	 | connection_status 	 | | - 	 | |
| %k 	 | keepalives 	 | `\d+` 	 | - 	 | |
| %r 	 | request_line 	 | `(?<request_method>\w+) (?<request_path>\S+) | - 	 | |
| %D 	 | request_duration_microseconds 	 | `\d+` 	 | - 	 | |
| %T 	 | request_duration_scaled 	 | `[\d.]+` 	 | - 	 | |
| %{s}T 	 | request_duration_seconds 	 | `\d+` 	 | - 	 | |
| %{us}T 	 | request_duration_microseconds 	 | `\d+` 	 | - 	 | |
| %{ms}T 	 | request_duration_milliseconds 	 | `\d+` 	 | - 	 | |
| %U 	 | request_uri 	 | `\S+(?<!")` 	 | - 	 | |
| %s 	 | status 	 | `\d+` 	 | - 	 | |
| %>s 	 | status 	 | | - 	 | |
| %R 	 | handler 	 | | - 	 | |
| %^FU 	 | ttfu 	 | `-¦\d+` 	 | - 	 | |
| %^FB 	 | ttfb 	 | `-¦\d+` 	 | - 	 | |
| %^ĴS 	 | json 	 | | - 	 | |
| %{Referer}i 	 | referer 	 | `[^"]*` 	 | - 	 | |
| %{User-Agent}i 	 | user_agent 	 | | - 	 | |
| | request_time 	 | `None` 	 | strftime 	 | |
| | $1 	 | `\S+` 	 | None 	 | |
| | $1 	 | `\S+` 	 | None 	 | |


## strftime

| placeholder 	 | id 	 | regex 	 	 | grok/fmt-recursion 	 | description/reference 	 |
-------------------------------------------------------------------------------------------
| %a 	 | tm_wday 	 | `\w+` 	 | - 	 | |
| %A 	 | tm_wday 	 | `\w+` 	 | - 	 | |
| %b 	 | tm_mon 	 | `\w+` 	 | - 	 | |
| %B 	 | tm_mon 	 | `\w+` 	 | - 	 | |
| %c 	 | tm_dt 	 | | - 	 | |
| %C 	 | tm_cent 	 | | - 	 | |
| %d 	 | tm_mday 	 | | - 	 | |
| %D 	 | tm_mdy 	 | | - 	 | |
| %e 	 | tm_mday 	 | | - 	 | |
| %F 	 | tm_date 	 | | - 	 | |
| %G 	 | tm_wyear 	 | | - 	 | |
| %g 	 | tm_wyearnc 	 | | - 	 | |
| %h 	 | tm_mon 	 | `\w+` 	 | - 	 | |
| %H 	 | tm_hour 	 | | - 	 | |
| %I 	 | tm_hour 	 | | - 	 | |
| %j 	 | tm_yday 	 | | - 	 | |
| %k 	 | tm_hour 	 | | - 	 | |
| %l 	 | tm_hour 	 | | - 	 | |
| %m 	 | tm_mon 	 | | - 	 | |
| %M 	 | tm_min 	 | | - 	 | |
| %n 	 | newline 	 | `\n` 	 | - 	 | |
| %p 	 | tm_ampm 	 | `AM¦PM` 	 | - 	 | |
| %P 	 | tm_ampm 	 | `am¦pm` 	 | - 	 | |
| %r 	 | tm_time 	 | [AMPM]{2}` 	 | - 	 | |
| %R 	 | tm_time 	 | | - 	 | |
| %s 	 | tm_epoch 	 | `\d+` 	 | - 	 | |
| %S 	 | tm_sec 	 | | - 	 | |
| %t 	 | tab 	 | `\t` 	 | - 	 | |
| %T 	 | tm_time 	 | | - 	 | |
| %u 	 | tm_wday 	 | `[1-7]` 	 | - 	 | |
| %U 	 | tm_yday 	 | `[0-5]\d¦5[0123]` 	 | - 	 | |
| %V 	 | tm_yday 	 | | - 	 | |
| %w 	 | tm_wday 	 | `[0-6]` 	 | - 	 | |
| %W 	 | tm_yday 	 | | - 	 | |
| %x 	 | tm_ldate 	 | `[-./\d]+` 	 | - 	 | |
| %X 	 | tm_ltime 	 | `[:.\d]+` 	 | - 	 | |
| %y 	 | tm_year 	 | | - 	 | |
| %Y 	 | tm_year 	 | | - 	 | |
| %z 	 | tm_tz 	 | | - 	 | |
| %Z 	 | tm_tz 	 | `\w+` 	 | - 	 | |
| %+ 	 | tm_date 	 | `[-/:. | - 	 | |
| %% 	 | percent 	 | `%` 	 | - 	 | |


## grok

| placeholder 	 | id 	 | regex 	 	 | grok/fmt-recursion 	 | description/reference 	 |
-------------------------------------------------------------------------------------------
| |  	 | `None` 	 | grok 	 | [grok |
| | $1 	 | `[a-zA-Z0-9._-]+` 	 | USERNAME 	 | [grok |
| | $1 	 | `[a-zA-Z0-9._-]+` 	 | USER 	 | [grok |
| | $1 	 | `(?:[+-]?(?:[0-9]+))` 	 | INT 	 | [grok |
| | $1 	 | `(?<![0-9.+-])(?>[+-]?(?:(?:[0-9]+(?:\.[0-9]+)?)¦(?…` 	 | BASE10NUM 	 | [grok |
| | $1 	 | `(?:(?<![0-9.+-])(?>[+-]?(?:(?:[0-9]+(?:\.[0-9]+)?)…` 	 | NUMBER 	 | [grok |
| | $1 	 | `(?<![0-9A-Fa-f])(?:[+-]?(?:0x)?(?:[0-9A-Fa-f]+))` 	 | BASE16NUM 	 | [grok |
| | $1 	 | `(?<![0-9A-Fa-f.])(?:[+-]?(?:0x)?(?:(?:[0-9A-Fa-f]…` 	 | BASE16FLOAT 	 | [grok |
| | $1 	 | `(?:[1-9][0-9]*)` 	 | POSINT 	 | [grok |
| | $1 	 | `(?:[0-9]+)` 	 | NONNEGINT 	 | [grok |
| | $1 	 | `\w+` 	 | WORD 	 | [grok |
| | $1 	 | `\S+` 	 | NOTSPACE 	 | [grok |
| | $1 	 | `\s*` 	 | SPACE 	 | [grok |
| | $1 	 | `.*?` 	 | DATA 	 | [grok |
| | $1 	 | `.*` 	 | GREEDYDATA 	 | [grok |
| | $1 	 | | QUOTEDSTRING 	 | [grok |
| | $1 	 | `[A-Fa-f0-9]{8}-(?:[A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{1…` 	 | UUID 	 | [grok |
| | $1 	 | `(?:(?:(?:[A-Fa-f0-9]{4}\.){2}[A-Fa-f0-9]{4})¦(?:(?…` 	 | MAC 	 | [grok |
| | $1 	 | `(?:(?:[A-Fa-f0-9]{4}\.){2}[A-Fa-f0-9]{4})` 	 | CISCOMAC 	 | [grok |
| | $1 	 | `(?:(?:[A-Fa-f0-9]{2}-){5}[A-Fa-f0-9]{2})` 	 | WINDOWSMAC 	 | [grok |
| | $1 	 | `(?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2})` 	 | COMMONMAC 	 | [grok |
| | $1 	 | `((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}¦:))¦(([0…` 	 | IPV6 	 | [grok |
| | $1 	 | `(?<![0-9])(?:(?:25[0-5]¦2[0-4][0-9]¦[0-1]?[0-9]{1,…` 	 | IPV4 	 | [grok |
| | $1 	 | `(?:((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}¦:))¦(…` 	 | IP 	 | [grok |
| | $1 	 | `(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za…` 	 | HOSTNAME 	 | [grok |
| | $1 	 | `(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za…` 	 | HOST 	 | [grok |
| | $1 	 | `(?:(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A…` 	 | IPORHOST 	 | [grok |
| | $1 	 | `(?:(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A…` 	 | HOSTPORT 	 | [grok |
| | $1 	 | | PATH 	 | [grok |
| | $1 	 | | UNIXPATH 	 | [grok |
| | $1 	 | | TTY 	 | [grok |
| | $1 	 | | WINPATH 	 | [grok |
| | $1 	 | `[A-Za-z]+(\+[A-Za-z+]+)?` 	 | URIPROTO 	 | [grok |
| | $1 	 | `(?:(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A…` 	 | URIHOST 	 | [grok |
| | $1 	 | `(?:/[A-Za-z0-9$.+!*'(){},~:;=@#%_\-]*)+` 	 | URIPATH 	 | [grok |
| | $1 	 | | URIPARAM 	 | [grok |
| | $1 	 | | URIPATHPARAM 	 | [grok |
| | $1 	 | | URI 	 | [grok |
| | $1 	 | `(?:Jan(?:uary)?¦Feb(?:ruary)?¦Mar(?:ch)?¦Apr(?:il…` 	 | MONTH 	 | [grok |
| | $1 	 | `(?:0?[1-9]¦1[0-2])` 	 | MONTHNUM 	 | [grok |
| | $1 	 | `(?:0[1-9]¦1[0-2])` 	 | MONTHNUM2 	 | [grok |
| | $1 	 | `(?:(?:0[1-9])¦(?:[12][0-9])¦(?:3[01])¦[1-9])` 	 | MONTHDAY 	 | [grok |
| | $1 	 | `(?:Mon(?:day)?¦Tue(?:sday)?¦Wed(?:nesday)?¦Thu(?:r…` 	 | DAY 	 | [grok |
| | $1 	 | | YEAR 	 | [grok |
| | $1 	 | `(?:2[0123]¦[01]?[0-9])` 	 | HOUR 	 | [grok |
| | $1 	 | `(?:[0-5][0-9])` 	 | MINUTE 	 | [grok |
| | $1 	 | `(?:(?:[0-5]?[0-9]¦60)(?:[:.,][0-9]+)?)` 	 | SECOND 	 | [grok |
| | $1 	 | `(?!<[0-9])(?:2[0123]¦[01]?[0-9]):(?:[0-5][0-9])(?:…` 	 | TIME 	 | [grok |
| | $1 	 | `(?:0?[1-9]¦1[0-2])[/-](?:(?:0[1-9])¦(?:[12][0-9])¦…` 	 | DATE_US 	 | [grok |
| | $1 	 | `(?:(?:0[1-9])¦(?:[12][0-9])¦(?:3[01])¦[1-9])[./-](…` 	 | DATE_EU 	 | [grok |
| | $1 	 | `(?:Z¦[+-](?:2[0123]¦[01]?[0-9])(?::?(?:[0-5][0-9])…` 	 | ISO8601_TIMEZONE 	 | [grok |
| | $1 	 | `(?:(?:(?:[0-5]?[0-9]¦60)(?:[:.,][0-9]+)?)¦60)` 	 | ISO8601_SECOND 	 | [grok |
| | $1 	 | | TIMESTAMP_ISO8601 	 | [grok |
| | $1 	 | `(?:0?[1-9]¦1[0-2])[/-](?:(?:0[1-9])¦(?:[12][0-9])¦…` 	 | DATE 	 | [grok |
| | $1 	 | `(?:0?[1-9]¦1[0-2])[/-](?:(?:0[1-9])¦(?:[12][0-9])¦…` 	 | DATESTAMP 	 | [grok |
| | $1 	 | `(?:[PMCE][SD]T¦UTC)` 	 | TZ 	 | [grok |
| | $1 	 | `(?:Mon(?:day)?¦Tue(?:sday)?¦Wed(?:nesday)?¦Thu(?:r…` 	 | DATESTAMP_RFC822 	 | [grok |
| | $1 	 | `(?:Mon(?:day)?¦Tue(?:sday)?¦Wed(?:nesday)?¦Thu(?:r…` 	 | DATESTAMP_RFC2822 	 | [grok |
| | $1 	 | `(?:Mon(?:day)?¦Tue(?:sday)?¦Wed(?:nesday)?¦Thu(?:r…` 	 | DATESTAMP_OTHER 	 | [grok |
| | $1 	 | | DATESTAMP_EVENTLOG 	 | [grok |
| | $1 	 | `(?:Jan(?:uary)?¦Feb(?:ruary)?¦Mar(?:ch)?¦Apr(?:il…` 	 | SYSLOGTIMESTAMP 	 | [grok |
| | $1 	 | `(?:[\w._/%-]+)` 	 | PROG 	 | [grok |
| | $1 	 | | SYSLOGPROG 	 | [grok |
| | $1 	 | `(?:(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A…` 	 | SYSLOGHOST 	 | [grok |
| | $1 	 | `<(?<facility>(?:[0-9]+)).(?<priority>(?:[0-9]+)…` 	 | SYSLOGFACILITY 	 | [grok |
| | $1 	 | `(?:(?:0[1-9])¦(?:[12][0-9])¦(?:3[01])¦[1-9])/(?:J…` 	 | HTTPDATE 	 | [grok |
| | $1 	 | | QS 	 | [grok |
| | $1 	 | `([Aa]lert¦ALERT¦[Tt]race¦TRACE¦[Dd]ebug¦DEBUG¦[Nn]…` 	 | LOGLEVEL 	 | [grok |