Sumologic parsing expressions for IIS Failed Request Tracing logs

FailedRequestHeaderParser.txt

"<failedRequest " 
| kv regex "=\"([^\"]*)\"" 
  keys "url"
  , "siteId"
  , "appPoolId"
  , "processId"
  , "verb"
  , "remoteUserName"
  , "userName"
  , "tokenUserName"
  , "authenticationType"
  , "activityId"
  , "failureReason"
  , "statusCode"
  , "triggerStatusCode"
  , "timeTaken"

SumoIISFailedRequestEventParser.txt

| parse XML 
"/Event/System/Provider/@Name", 
"/Event/RenderingInfo/Keywords/Keyword/text()", 
"/Event/System/Correlation/@ActivityID", 
"/Event/System/Execution/@ProcessID", 
"/Event/System/Execution/@ThreadID", 
"/Event/System/Computer/text()", 
"/Event/System/Level/text()", 
"/Event/RenderingInfo/Opcode/text()", 
"/Event/EventData/Data[@Name=\"ModuleName\"]/text()", 
"/Event/EventData/Data[@Name=\"ContextId\"]/text()", 
"/Event/EventData/Data[@Name=\"Notification\"]/text()", 
"/Event/EventData/Data[@Name=\"NotificationStatus\"]/text()", 
"/Event/EventData/Data[@Name=\"Data1\"]/text()" ,
"/Event/EventData/Data[@Name=\"Data2\"]/text()" ,
"/Event/EventData/Data[@Name=\"Data3\"]/text()" ,
"/Event/EventData/Data[@Name=\"Data4\"]/text()" ,
"/Event/EventData/Data[@Name=\"AuthTypeSupported\"]/text()",
"/Event/EventData/Data[@Name=\"AuthType\"]/text()",
"/Event/EventData/Data[@Name=\"UserName\"]/text()",
"/Event/EventData/Data[@Name=\"SupportsIsInRole\"]/text()",
"/Event/EventData/Data[@Name=\"RemoteAddress\"]/text()" ,
"/Event/EventData/Data[@Name=\"RemotePort\"]/text()" ,
"/Event/EventData/Data[@Name=\"LocalAddress\"]/text()" ,
"/Event/EventData/Data[@Name=\"LocalPort\"]/text()" ,
"/Event/EventData/Data[@Name=\"HeaderName\"]/text()" ,
"/Event/EventData/Data[@Name=\"HeaderValue\"]/text()" ,
"/Event/EventData/Data[@Name=\"Replace\"]/text()" ,
"/Event/EventData/Data[@Name=\"OldHandlerName\"]/text()" ,
"/Event/EventData/Data[@Name=\"NewHandlerName\"]/text()",
"/Event/EventData/Data[@Name=\"NewHandlerModules\"]/text()",
"/Event/EventData/Data[@Name=\"NewHandlerScriptProcessor\"]/text()",
"/Event/EventData/Data[@Name=\"NewHandlerType\"]/text()",
"/Event/EventData/Data[@Name=\"PhysicalPath\"]/text()",
"/Event/EventData/Data[@Name=\"AccessPerms\"]/text()"
as EventProvider,Keyword,ActivityID,ProcessID,ThreadID,Computer,Level,OpCode,Module,ContextId
  ,Notification,NotificationStatus,Data1,Data2,Data3,Data4,AuthTypeSupported,AuthType,UserName,SupportsIsInRole
  ,RemoteAddress,RemotePort,LocalAddress,LocalPort,HeaderName,HeaderValue,Replace
  ,OldHandlerName,NewHandlerName,NewHandlerModules,NewHandlerScriptProessor,NewHandlerType
  ,PhysicalPath,AccessPerms nodrop

| isNull(Level) ? "" : Level as Level
| (Level = "0") ? "Always" : Level as Level
| (Level = "1") ? "Critical" : Level as Level
| (Level = "2") ? "Error" : Level as Level
| (Level = "3") ? "Warning" : Level as Level
| (Level = "4") ? "Info" : Level as Level
| (Level = "5") ? "Verbose" : Level as Level
| isNull(Notification) ? "" : Notification as Notification
| (Notification = "1") ? "BEGIN_REQUEST" : Notification as Notification
| (Notification = "2") ? "AUTHENTICATE_REQUEST" : Notification as Notification
| (Notification = "4") ? "AUTHORIZE_REQUEST" : Notification as Notification
| (Notification = "8") ? "RESOLVE_REQUEST_CACHE" : Notification as Notification
| (Notification = "16") ? "MAP_REQUEST_HANDLER" : Notification as Notification
| (Notification = "32") ? "REQUEST_ACQUIRE_STATE" : Notification as Notification
| (Notification = "64") ? "PRE_EXECUTE_REQUEST_HANDLER" : Notification as Notification
| (Notification = "128") ? "EXECUTE_REQUEST_HANDLER" : Notification as Notification
| isNull(NotificationStatus) ? "" : NotificationStatus as NotificationStatus
| (NotificationStatus = "0") ? "NOTIFICATION_CONTINUE" : NotificationStatus as NotificationStatus
| (NotificationStatus = "134217730") ? "SF_STATUS_REQ_NEXT_NOTIFICATION" : NotificationStatus as NotificationStatus
| isNull(AuthTypeSupported) ? "" : AuthTypeSupported as AuthTypeSupported
| (AuthTypeSupported = "1") ? "Anonymous" : AuthTypeSupported as AuthTypeSupported
| (AuthTypeSupported = "2") ? "Basic" : AuthTypeSupported as AuthTypeSupported
| (AuthTypeSupported = "4") ? "NT" : AuthTypeSupported as AuthTypeSupported
| (AuthTypeSupported = "16") ? "Digest" : AuthTypeSupported as AuthTypeSupported
| (AuthTypeSupported = "128") ? "MapCliCert" : AuthTypeSupported as AuthTypeSupported