/
^(?P<date>\d{4}-\d+-\d+)\s+(?P<time>\d+:\d+:\d+)\s+(?P<ip>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})\s+(?P<method>\w+)\s+(?P<uri>\/.*)\s+(?P<status>\d+)\s+(?P<bytes>\d+)\s+(?P<referer>\".*\")\s+(?P<useragent>\".*\")\s+(?P<cookie>\".*\")\s+(?P<custom>\".*\")\s+(?P<ghostip>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})\s+(?P<cache>\d)\s+(?P<wafinfo>\".*\")$
/
gm