<decoder name="pix-fw9">
  <parent>pix</parent>
  <type>firewall</type>
  <prematch offset="after_parent">^5-106100|^6-106100|^3-106100|</prematch>
  <prematch>^4-106100</prematch>
  <regex offset="after_parent">^(\S+): access-list \S+ (\w+) </regex>
  <regex>(\w+) \w+/(\d+.\d+.\d+.\d+)\((\d+)\) -\p \w+/(\d+.\d+.\d+.\d+)\((\d+)\)</regex>
  <regex>\.+ [\w+, \w+]$</regex>
  <order>id, action, protocol, srcip, srcport, dstip, dstport</order>
</decoder>