COLOR magenta
{
# matches the date
^(... ... ..).*$
}

COLOR cyan
{
# matches the time
^... ... .. (..:..:..).*$
}

COLOR green
{
# matches the hostname
^... ... .. ..:..:.. ([^ ]+).*$
}

COLOR yellow
{
# matches the "program" that wrote to syslog
^... ... .. ..:..:.. [^ ]+ ([^ ]+)
}

COLOR brightyellow
{
# matches all ip adresses
^.*([0-9]{3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
^.*([0-9]{2}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
^.*([0-9]{1}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
# matches two ip adresses in one line
^.*([0-9]{3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*([0-9]{3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
^.*([0-9]{2}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*([0-9]{2}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
^.*([0-9]{1}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*([0-9]{1}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
}

COLOR brightred
{
# matches the word root
^.*(root).*$
# matches DENY
^.*(ppp-in DENY ppp0).*$
^.*(eth-in DENY eth0).*$
}

COLOR brightblue
{
# matches the output from the "program"
^... ... .. ..:..:.. [^ ]+ [^ ]+ (.*)
}