From d7ceb15905615b5325026932071f96646e2a9129 Mon Sep 17 00:00:00 2001
From: Miguel Casares <miguel_27793@hotmail.com>
Date: Mon, 2 Jul 2018 18:09:22 +0200
Subject: [PATCH 1/5] Fix Windows accesslog IIS decoder

---
 decoders/0380-windows_decoders.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/decoders/0380-windows_decoders.xml b/decoders/0380-windows_decoders.xml
index 4bdab425b..547be2f32 100644
--- a/decoders/0380-windows_decoders.xml
+++ b/decoders/0380-windows_decoders.xml
@@ -90,8 +90,8 @@
   <type>web-log</type>
   <use_own_name>true</use_own_name>
   <prematch offset="after_parent">^\S+ GET |^\S+ POST </prematch>
-  <regex offset="after_prematch">(\S+ \S*) \.* (\S+) \S*\.* (\d\d\d) \S+ \S+ \S+</regex>
-  <order>url,srcip,id</order>
+  <regex offset="after_prematch">(\S+ \S+) (\S+) \S+ (\S+) (\S+) \.*(\d\d\d) \S* \S* \S*</regex>
+  <order>url, ServerPort, ClientIP, UserAgent, id</order>
 </decoder>
 
 <!-- IIS 5 W3C FTP log format.

From 09106939c546e263831f2fb33efa7c79ab674294 Mon Sep 17 00:00:00 2001
From: Miguel Casares <miguel_27793@hotmail.com>
Date: Tue, 3 Jul 2018 13:22:02 +0200
Subject: [PATCH 2/5] 0380-windows_decoders.xml

---
 decoders/0380-windows_decoders.xml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/decoders/0380-windows_decoders.xml b/decoders/0380-windows_decoders.xml
index 547be2f32..e632d9c9c 100644
--- a/decoders/0380-windows_decoders.xml
+++ b/decoders/0380-windows_decoders.xml
@@ -89,9 +89,9 @@
   <parent>windows-date-format</parent>
   <type>web-log</type>
   <use_own_name>true</use_own_name>
-  <prematch offset="after_parent">^\S+ GET |^\S+ POST </prematch>
-  <regex offset="after_prematch">(\S+ \S+) (\S+) \S+ (\S+) (\S+) \.*(\d\d\d) \S* \S* \S*</regex>
-  <order>url, ServerPort, ClientIP, UserAgent, id</order>
+  <prematch offset="after_parent">^\S+</prematch>
+  <regex offset="after_prematch">(\w+) (\S+ \S+) (\S+) \S+ (\S+) (\S+) \.*(\d\d\d) </regex>
+  <order>action, url, scrport, scrip, user_agent, id</order>
 </decoder>
 
 <!-- IIS 5 W3C FTP log format.

From 178a6e685b47ee9547d39294f737933698c90fdd Mon Sep 17 00:00:00 2001
From: Miguel Casares <miguel_27793@hotmail.com>
Date: Tue, 17 Jul 2018 17:41:31 +0200
Subject: [PATCH 3/5] Final fixed decoder

---
 decoders/0380-windows_decoders.xml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/decoders/0380-windows_decoders.xml b/decoders/0380-windows_decoders.xml
index e632d9c9c..30fd77229 100644
--- a/decoders/0380-windows_decoders.xml
+++ b/decoders/0380-windows_decoders.xml
@@ -89,11 +89,12 @@
   <parent>windows-date-format</parent>
   <type>web-log</type>
   <use_own_name>true</use_own_name>
-  <prematch offset="after_parent">^\S+</prematch>
-  <regex offset="after_prematch">(\w+) (\S+ \S+) (\S+) \S+ (\S+) (\S+) \.*(\d\d\d) </regex>
-  <order>action, url, scrport, scrip, user_agent, id</order>
+  <prematch offset="after_parent">^\S+ GET |^\S+ POST</prematch>
+  <regex offset="after_parent">^\S+ (\w+) (\S+ \S+) (\S+) \S+ (\S+) (\S+) \.*(\d\d\d) </regex>
+  <order>action, url, srcport, srcip, user_agent, id</order>
 </decoder>
 
+
 <!-- IIS 5 W3C FTP log format.
   - Examples:
   - #Fields: date time c-ip cs-username s-sitename s-computername s-ip s-port cs-method cs-uri-stem cs-uri-query sc-status sc-win32-status sc-bytes cs-bytes time-taken cs-version cs-host cs(User-Agent) cs(Cookie) cs(Referer)

From 51f5a1e3f7ef0c36fbb73e466ba0a58a65069dae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eva=20L=C3=B3pez=20Ruiz?=
 <17710550+Lopuiz@users.noreply.github.com>
Date: Wed, 14 Aug 2019 09:28:24 +0200
Subject: [PATCH 4/5] fix web-accesslog-iis-default decoder

---
 decoders/0380-windows_decoders.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/decoders/0380-windows_decoders.xml b/decoders/0380-windows_decoders.xml
index 096a630f3..ee7b26571 100644
--- a/decoders/0380-windows_decoders.xml
+++ b/decoders/0380-windows_decoders.xml
@@ -90,7 +90,7 @@
   <type>web-log</type>
   <use_own_name>true</use_own_name>
   <prematch offset="after_parent">^\S+ GET |^\S+ POST</prematch>
-  <regex offset="after_parent">^\S+ (\w+) (\S+ \S+) (\S+) \S+ (\S+) (\S+) \.*(\d\d\d) </regex>
+  <regex offset="after_parent">^\S+ (\w+) (\S+ \S+) (\S+) \S+ (\S+) (\S+) \.* (\d\d\d) </regex>
   <order>action, url, srcport, srcip, user_agent, id</order>
 </decoder>
 

From 45c714489fc7e1390775f13ac21f4f5dfdc9af13 Mon Sep 17 00:00:00 2001
From: Lopuiz <lopezziur@gmail.com>
Date: Wed, 14 Aug 2019 10:31:12 +0200
Subject: [PATCH 5/5] fix web-accesslog-iis-default decoder

---
 decoders/0380-windows_decoders.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/decoders/0380-windows_decoders.xml b/decoders/0380-windows_decoders.xml
index ee7b26571..096a630f3 100644
--- a/decoders/0380-windows_decoders.xml
+++ b/decoders/0380-windows_decoders.xml
@@ -90,7 +90,7 @@
   <type>web-log</type>
   <use_own_name>true</use_own_name>
   <prematch offset="after_parent">^\S+ GET |^\S+ POST</prematch>
-  <regex offset="after_parent">^\S+ (\w+) (\S+ \S+) (\S+) \S+ (\S+) (\S+) \.* (\d\d\d) </regex>
+  <regex offset="after_parent">^\S+ (\w+) (\S+ \S+) (\S+) \S+ (\S+) (\S+) \.*(\d\d\d) </regex>
   <order>action, url, srcport, srcip, user_agent, id</order>
 </decoder>