COLOR magenta
{
# matches the date
^(... ..).*$
^.*([0-9][0-9]\.[0-9]%).*$
}

COLOR cyan
{
^.*\[=*>(\.*)].*$
# matches the time
^... .. (..:..:..).*$
}

COLOR green
{
^.*\[=*(>)\.*].*$
# matches the hostname
^... .. ..:..:.. ([^ ]+).*$
^.*(sync'ed).*$
}

COLOR yellow
{
# matches the "program" that wrote to syslog
^... .. ..:..:.. [^ ]+ ([^ ]+)
}

COLOR brightyellow
{
^.*\[(=*)>\.*].*$
# matches all ip adresses
^.*([0-9]{3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
^.*([0-9]{2}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
^.*([0-9]{1}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
# matches two ip adresses in one line
^.*([0-9]{3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*([0-9]{3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
^.*([0-9]{2}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*([0-9]{2}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
^.*([0-9]{1}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*([0-9]{1}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
}

COLOR brightred
{
# matches the word root
^.*(\[)=*>\.*].*$
^.*\[=*>\.*(]).*$
^.*(root).*$
# matches DENY
^.*(ppp-in DENY ppp0).*$
^.*(eth-in DENY eth0).*$
^.*\([0-9]*/([0-9]*)\).*$
}

COLOR brightblue
{
# matches the output from the "program"
^... .. ..:..:.. [^ ]+ [^ ]+ (.*)
^.*\(([0-9]*)/[0-9]*\).*$
}