# object:
# {
#   "message": "[06/Nov/2014:19:10:38 +0600] 66.249.65.159 GET /news/53f8d72920ba2744fe873ebc.html 204 1245 5943 2.412 6.433 sessions_show app_name env_here 42 127.0.0.1 foo 123 \"error message here\" 456",
#   "file": "/var/log/nginx.log",
#   "source_type": "file"
# }
#
# result:
# {
#   "app": "app_name",
#   "code": 42,
#   "debug": "foo",
#   "env": "env_here",
#   "error": "error message here",
#   "host": "66.249.65.159",
#   "ip": "127.0.0.1",
#   "method": "GET",
#   "req_id": "456",
#   "req_len": 1245,
#   "res_len": 5943,
#   "status": 204,
#   "status_class": "2xx",
#   "t_time": 2412.0,
#   "timestamp": "2014-11-06T13:10:38Z",
#   "u_time": 6433.0,
#   "uri": "/manage/v1/sessions/REDACTED",
#   "user_id": "123",
#   "x_route": "sessions_show"
# }

# parse message
parsed = parse_tokens!(.message)

# delete unused fields
del(.file)
del(.message)
del(.source_type)

# assign parsed fields
.timestamp = parse_timestamp!(parsed[0], "%d/%b/%Y:%H:%M:%S %z")
.host = parsed[1]
.method = parsed[2]
.uri = parsed[3]
.status = to_int!(parsed[4])
.req_len = to_int!(parsed[5])
.res_len = to_int!(parsed[6])
if (t_time, err = to_float(parsed[7]); err == null) {
    .t_time = t_time * 1000
}
if (u_time, err = to_float(parsed[8]); err == null) {
    .u_time = u_time * 1000
}
.x_route = parsed[9]
.app = parsed[10]
.env = parsed[11]
.code = to_int!(parsed[12])
.ip = parsed[13]
.debug = parsed[14]
.user_id = parsed[15]
.error = parsed[16]
.req_id = parsed[17]

# add additional context
if .x_route == "sessions_show" || .x_route == "sessions_delete" {
    .uri = "/manage/v1/sessions/REDACTED"
}

.status_class = to_string(to_int(floor(.status / 100))) + "xx"

.
