%s{mon} %02d{dd} %02d{hh}:%02d{mm}:%02d{ss} zscaler-nss:LEEF:1.0|Zscaler|NSS|4.1|%s{reason}|cat=%s{action}\tdevTime=%s{mon} %02d{dd} %d{yy} %02d{hh}:%02d{mm}:%02d{ss} %s{tz}\tdevTimeFormat=MMM dd yyyy HH:mm:ssz\tsrc=%s{cip}\tdst=%s{sip}\tsrcPostNAT=%s{cintip}\trealm=%s{location}\tusrName=%s{login}\tsrcBytes=%d{reqsize}\tdstBytes=%d{respsize}\trole=%s{dept}\tpolicy=%s{reason}\trecordid=%d{recordid}\tbwthrottle=%s{bwthrottle}\tuseragent=%s{ua}\treferer=%s{ereferer}\thostname=%s{ehost}\tappproto=%s{proto}\turlcategory=%s{urlcat}\turlsupercategory=%s{urlsupercat}\turlclass=%s{urlclass}\tappclass=%s{appclass}\tappname=%s{appname}\tmalwaretype=%s{malwarecat}\tmalwareclass=%s{malwareclass}\tthreatname=%s{threatname}\triskscore=%d{riskscore}\tdlpdict=%s{dlpdict}\tdlpeng=%s{dlpeng}\tfileclass=%s{fileclass}\tfiletype=%s{filetype}\treqmethod=%s{reqmethod}\trespcode=%s{respcode}\tmd5=%s{bamd5}\teurl=%s{eurl}\tologin=%s{ologin}\tthrottlereqsize=%d{throttlereqsize}\tthrottlerespsize=%d{throttlerespsize}\tdatacenter=%s{datacenter}\tdatacentercity=%s{datacentercity\tdatacentercountry=%s{datacentercountry}\tfilesubtype=%s{filesubtype}\tfilename=%s{filename}\treqdatasize=%d{reqdatasize}\treqhdrsize=%d{reqhdrsize}\trespdatasize=%d{respdatasize}\tresphdrsize=%d{resphdrsize}\ttotalsize=%d{totalsize}\treqversion=%s{reqversion}\trespversion=%s{respversion}\treferer=%s{referer}\tuaclass=%s{uaclass}\thost=%s{host}\trefererhost=%s{refererhost}\turl=%s{url}\tcltipv6=%s{cltipv6}\trulelabel=%s{rulelabel}\truletype=%s{ruletype}\tclientsslcipher=%s{clientsslcipher}\tsrvsslcipher=%s{srvsslcipher}\tsrvtlsversion=%s{srvtlsversion}\tsrvcertchainvalpass=%s{srvcertchainvalpass}\tsrvwildcardcert=%s{srvwildcardcert}\tserversslsessreuse=%s{serversslsessreuse}\tsrvcertvalidationtype=%s{srvcertvalidationtype}\tsrvcertvalidityperiod=%s{srvcertvalidityperiod}\tdevicehostname=%s{devicehostname}\todevicehostname=%s{odevicehostname}\tdevicemodel=%s{devicemodel}\tdevicename=%s{devicename}\todevicename=%s{odevicename}\tdeviceosversion=%s{deviceosversion}\tdeviceowner=%s{deviceowner}\todeviceowner=%s{odeviceowner}\tdeviceappversion=%s{deviceappversion}\tztunnelversion=%s{ztunnelversion}\tproductversion=%s{productversion}\tnsssvcip=%s{nsssvcip}\teedone=%s{eedone}\n