lnav.org FTP log format (work in progress).

ftp.json

{
  "ftp_log" : {
      "title" : "FTP XFER log format",
      "description" : "The default FTP/XFERLOG server log.",
      "url" : "http://www.proftpd.org/docs/howto/Logging.html",
      "multiline" : false,
      "regex" : {
        "core": {
          "pattern" : "^(?<timestamp>\\w{3}\\ \\w{3}\\ \\d{2}\\ \\d{2}\\:\\d{2}\\:\\d{2}\\ \\d{4})\\ (?<xfer_time>\\d{1,9})\\ (?<remote_ip>\\d{1,3}\\.\\d{1,3}.\\d{1,3}.\\d{1,3})\\ (?<file_size>\\d{1,})\\ (?<file_name>\/\\S{1,})\\ (?<xfer_type>\\w{1})\\ (?<xfer_flag>\\S{1,})\\ (?<xfer_direction>\\w{1,})\\ (?<xfer_mode>\\w{1,})\\ (?<xfer_user>\\S{1,})\\ (?<xfer_service>\\w{1,})\\ (?<xfer_auth_method>\\w{1,})\\ (?<xfer_auth_id>\\S{1,})\\ (?<xfer_status>\\w{1,})$"
        }
      },
      "body-field": "file_name",
      "opid-field": "remote_ip",
      "level-field": "xfer_status",
      "level" : {
        "error" : "i"
          },
      "value" : {
          "xfer_time" : {
              "kind" : "integer"
          },
          "remote_ip" : {
              "kind" : "string",
              "identifier" : true
          },
          "file_size" : {
              "kind" : "integer"
          },
          "file_name" : {
              "kind" : "string",
              "identifier" : true
          },
          "xfer_type" : {
              "kind" : "string"
          },
          "xfer_flag" : {
              "kind" : "string"
          },
          "xfer_time" : {
              "kind" : "string"
          },
          "xfer_direction" : {
              "kind" : "string",
              "identifier" : true
          },
          "xfer_mode" : {
              "kind" : "string",
              "identifier" : true
          },
          "xfer_user" : {
              "kind" : "string",
              "identifier" : true
          },
          "xfer_service" : {
              "kind" : "string"
          },
          "xfer_auth_method" : {
              "kind" : "integer",
              "identifier" : true
          },
          "xfer_auth_id" : {
              "kind" : "string",
              "identifier" : true
          },
          "xfer_status" : {
              "kind" : "string",
              "identifier" : true
          }
      },
      "sample" : [
          {
              "line" : "Fri May 13 19:41:50 2011 0 184.100.200.34 1376 /home/username/public_html/website/wp-content/themes/themename/layouts/plugin/css/screen.css a _ o r username ftp 1 * c"
          }
      ]
  }
}