COLOR magenta
{
# matches the date
^(... ..).*$
}

COLOR cyan
{
# matches the time
^... .. (..:..:..).*$
}

COLOR green
{
# matches the hostname
^... .. ..:..:.. ([^ ]+).*$
}

COLOR yellow
{
# matches the "program" that wrote to syslog
^... .. ..:..:.. [^ ]+ ([^ ]+)
}

COLOR brightyellow
{
# matches all ip adresses
^.*([0-9]{3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
^.*([0-9]{2}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
^.*([0-9]{1}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
# matches two ip adresses in one line
^.*([0-9]{3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*([0-9]{3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
^.*([0-9]{2}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*([0-9]{2}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
^.*([0-9]{1}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*([0-9]{1}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
}

COLOR brightred
{
# matches the word root
^.*(root).*$
}

COLOR brightgreen
{
# matches sshd[??]: log: Connection from
^... .. ..:..:.. [^ ]+ (sshd\[[0-9]+\]: log: Connection from).*$
}

COLOR brightblue
{
# matches the output from the "program"
^... .. ..:..:.. [^ ]+ [^ ]+ (.*)
}