var arkimeparser = (function () {
    const o = function (k, v, o, l) {
            for (o = o || {}, l = k.length; l--; o[k[l]] = v);
            return o;
        },
        $V0 = [1, 6],
        $V1 = [1, 3],
        $V2 = [1, 4],
        $V3 = [1, 5],
        $V4 = [1, 8],
        $V5 = [1, 9],
        $V6 = [5, 18, 19, 23],
        $V7 = [14, 15, 16, 17];
    const parser = {
        trace: function trace() {},
        yy: {
            fieldsMap: {
                ip: {
                    friendlyName: "All IP fields",
                    group: "general",
                    help: "Search all ip fields",
                    type: "ip",
                    dbField2: "ipall",
                    noFacet: "true",
                    dbField: "ipall",
                    exp: "ip",
                },
                port: {
                    friendlyName: "All port fields",
                    group: "general",
                    help: "Search all port fields",
                    type: "integer",
                    dbField2: "portall",
                    regex: "(^port\\.(?:(?!\\.cnt$).)*$|\\.port$)",
                    dbField: "portall",
                    exp: "port",
                },
                rir: {
                    friendlyName: "All rir fields",
                    group: "general",
                    help: "Search all rir fields",
                    type: "uptermfield",
                    dbField2: "rirall",
                    regex: "(^rir\\.(?:(?!\\.cnt$).)*$|\\.rir$)",
                    dbField: "rirall",
                    exp: "rir",
                },
                country: {
                    friendlyName: "All country fields",
                    group: "general",
                    help: "Search all country fields",
                    type: "uptermfield",
                    dbField2: "geoall",
                    regex: "(^country\\.(?:(?!\\.cnt$).)*$|\\.country$)",
                    dbField: "geoall",
                    exp: "country",
                },
                asn: {
                    friendlyName: "All ASN fields",
                    group: "general",
                    help: "Search all ASN fields",
                    type: "termfield",
                    dbField2: "asnall",
                    regex: "(^asn\\.(?:(?!\\.cnt$).)*$|\\.asn$)",
                    dbField: "asnall",
                    exp: "asn",
                },
                host: {
                    friendlyName: "All Host fields",
                    group: "general",
                    help: "Search all Host fields",
                    type: "lotermfield",
                    dbField2: "hostall",
                    regex: "(^host\\.(?:(?!\\.(cnt|tokens)$).)*$|\\.host$)",
                    dbField: "hostall",
                    exp: "host",
                    transform: "removeProtocolAndURI",
                },
                "source.as.number": {
                    friendlyName: "Src ASN Number",
                    group: "general",
                    help: "GeoIP ASN Number calculated from the source IP",
                    type: "integer",
                    fieldECS: "source.as.number",
                    dbField: "source.as.number",
                    exp: "source.as.number",
                },
                "source.as.organization.name": {
                    friendlyName: "Src ASN Name",
                    group: "general",
                    help: "GeoIP ASN Name calculated from the source IP",
                    type: "termfield",
                    fieldECS: "source.as.organization.name",
                    dbField: "source.as.organization.name",
                    exp: "source.as.organization.name",
                },
                "rir.src": {
                    friendlyName: "Src RIR",
                    group: "general",
                    help: "Source RIR",
                    type: "uptermfield",
                    dbField2: "srcRIR",
                    category: "rir",
                    dbField: "srcRIR",
                    exp: "rir.src",
                },
                "destination.as.number": {
                    friendlyName: "Dst ASN Number",
                    group: "general",
                    help: "GeoIP ASN Number calculated from the destination IP",
                    type: "integer",
                    fieldECS: "destination.as.number",
                    dbField: "destination.as.number",
                    exp: "destination.as.number",
                },
                "destination.as.organization.name": {
                    friendlyName: "Dst ASN Name",
                    group: "general",
                    help: "GeoIP ASN Name calculated from the destination IP",
                    type: "termfield",
                    fieldECS: "destination.as.organization.name",
                    dbField: "destination.as.organization.name",
                    exp: "destination.as.organization.name",
                },
                "rir.dst": {
                    friendlyName: "Dst RIR",
                    group: "general",
                    help: "Destination RIR",
                    type: "uptermfield",
                    dbField2: "dstRIR",
                    category: "rir",
                    dbField: "dstRIR",
                    exp: "rir.dst",
                },
                databytes: {
                    friendlyName: "Data bytes",
                    group: "general",
                    help: "Total number of data bytes sent AND received in a session",
                    type: "integer",
                    dbField2: "totDataBytes",
                    dbField: "totDataBytes",
                    exp: "databytes",
                },
                "ip.protocol": {
                    friendlyName: "IP Protocol",
                    group: "general",
                    help: "IP protocol number or friendly name",
                    type: "lotermfield",
                    dbField2: "ipProtocol",
                    transform: "ipProtocolLookup",
                    dbField: "ipProtocol",
                    exp: "ip.protocol",
                },
                id: {
                    friendlyName: "Arkime ID",
                    group: "general",
                    help: "Arkime ID for the session",
                    type: "termfield",
                    dbField2: "_id",
                    noFacet: "true",
                    dbField: "_id",
                    exp: "id",
                },
                rootId: {
                    friendlyName: "Arkime Root ID",
                    group: "general",
                    help: "Arkime ID of the first session in a multi session stream",
                    type: "termfield",
                    dbField2: "rootId",
                    dbField: "rootId",
                    exp: "rootId",
                },
                node: {
                    friendlyName: "Arkime Node",
                    group: "general",
                    help: "Arkime node name the session was recorded on",
                    type: "termfield",
                    dbField2: "node",
                    dbField: "node",
                    exp: "node",
                },
                srcNode: {
                    friendlyName: "Arkime Source Node",
                    group: "general",
                    help: "Source Arkime node name the session was recorded on when using send to cluster",
                    type: "termfield",
                    dbField2: "srcNode",
                    dbField: "srcNode",
                    exp: "srcNode",
                },
                file: {
                    friendlyName: "Filename",
                    group: "general",
                    help: "Arkime offline pcap filename",
                    type: "fileand",
                    dbField2: "fileand",
                    dbField: "fileand",
                    exp: "file",
                },
                "payload8.src.hex": {
                    friendlyName: "Payload Src Hex",
                    group: "general",
                    help: "First 8 bytes of source payload in hex",
                    type: "lotermfield",
                    dbField2: "srcPayload8",
                    aliases: ["payload.src"],
                    dbField: "srcPayload8",
                    exp: "payload8.src.hex",
                },
                "payload.src": {
                    friendlyName: "Payload Src Hex",
                    group: "general",
                    help: "First 8 bytes of source payload in hex",
                    type: "lotermfield",
                    dbField2: "srcPayload8",
                    aliases: ["payload.src"],
                    dbField: "srcPayload8",
                    exp: "payload8.src.hex",
                },
                "payload8.src.utf8": {
                    friendlyName: "Payload Src UTF8",
                    group: "general",
                    help: "First 8 bytes of source payload in utf8",
                    type: "termfield",
                    dbField2: "srcPayload8",
                    transform: "utf8ToHex",
                    noFacet: "true",
                    dbField: "srcPayload8",
                    exp: "payload8.src.utf8",
                },
                "payload8.dst.hex": {
                    friendlyName: "Payload Dst Hex",
                    group: "general",
                    help: "First 8 bytes of destination payload in hex",
                    type: "lotermfield",
                    dbField2: "dstPayload8",
                    aliases: ["payload.dst"],
                    dbField: "dstPayload8",
                    exp: "payload8.dst.hex",
                },
                "payload.dst": {
                    friendlyName: "Payload Dst Hex",
                    group: "general",
                    help: "First 8 bytes of destination payload in hex",
                    type: "lotermfield",
                    dbField2: "dstPayload8",
                    aliases: ["payload.dst"],
                    dbField: "dstPayload8",
                    exp: "payload8.dst.hex",
                },
                "payload8.dst.utf8": {
                    friendlyName: "Payload Dst UTF8",
                    group: "general",
                    help: "First 8 bytes of destination payload in utf8",
                    type: "termfield",
                    dbField2: "dstPayload8",
                    transform: "utf8ToHex",
                    noFacet: "true",
                    dbField: "dstPayload8",
                    exp: "payload8.dst.utf8",
                },
                "payload8.hex": {
                    friendlyName: "Payload Hex",
                    group: "general",
                    help: "First 8 bytes of payload in hex",
                    type: "lotermfield",
                    dbField2: "fballhex",
                    regex: "^payload8.(src|dst).hex$",
                    dbField: "fballhex",
                    exp: "payload8.hex",
                },
                "payload8.utf8": {
                    friendlyName: "Payload UTF8",
                    group: "general",
                    help: "First 8 bytes of payload in hex",
                    type: "lotermfield",
                    dbField2: "fballutf8",
                    regex: "^payload8.(src|dst).utf8$",
                    dbField: "fballutf8",
                    exp: "payload8.utf8",
                },
                "scrubbed.by": {
                    friendlyName: "Scrubbed By",
                    group: "general",
                    help: "SPI data was scrubbed by",
                    type: "lotermfield",
                    dbField2: "scrubby",
                    dbField: "scrubby",
                    exp: "scrubbed.by",
                },
                view: {
                    friendlyName: "View Name",
                    group: "general",
                    help: "Arkime view name",
                    type: "viewand",
                    dbField2: "viewand",
                    noFacet: "true",
                    dbField: "viewand",
                    exp: "view",
                },
                starttime: {
                    friendlyName: "Start Time",
                    group: "general",
                    help: "Session Start Time",
                    type: "seconds",
                    type2: "date",
                    dbField2: "firstPacket",
                    dbField: "firstPacket",
                    exp: "starttime",
                },
                stoptime: {
                    friendlyName: "Stop Time",
                    group: "general",
                    help: "Session Stop Time",
                    type: "seconds",
                    type2: "date",
                    dbField2: "lastPacket",
                    dbField: "lastPacket",
                    exp: "stoptime",
                },
                huntId: {
                    friendlyName: "Hunt ID",
                    group: "general",
                    help: "The ID of the packet search job that matched this session",
                    type: "termfield",
                    dbField2: "huntId",
                    dbField: "huntId",
                    exp: "huntId",
                },
                huntName: {
                    friendlyName: "Hunt Name",
                    group: "general",
                    help: "The name of the packet search job that matched this session",
                    type: "termfield",
                    dbField2: "huntName",
                    dbField: "huntName",
                    exp: "huntName",
                },
                "databytes.src": {
                    friendlyName: "Src data bytes",
                    group: "general",
                    help: "Total number of data bytes sent by source in a session",
                    type: "integer",
                    dbField2: "srcDataBytes",
                    fieldECS: "client.bytes",
                    dbField: "client.bytes",
                    exp: "databytes.src",
                },
                "client.bytes": {
                    friendlyName: "Src data bytes",
                    group: "general",
                    help: "Total number of data bytes sent by source in a session",
                    type: "integer",
                    dbField2: "srcDataBytes",
                    fieldECS: "client.bytes",
                    dbField: "client.bytes",
                    exp: "databytes.src",
                },
                "bytes.dst": {
                    friendlyName: "Dst Bytes",
                    group: "general",
                    help: "Total number of raw bytes sent by destination in a session",
                    type: "integer",
                    dbField2: "dstBytes",
                    fieldECS: "destination.bytes",
                    dbField: "destination.bytes",
                    exp: "bytes.dst",
                },
                "destination.bytes": {
                    friendlyName: "Dst Bytes",
                    group: "general",
                    help: "Total number of raw bytes sent by destination in a session",
                    type: "integer",
                    dbField2: "dstBytes",
                    fieldECS: "destination.bytes",
                    dbField: "destination.bytes",
                    exp: "bytes.dst",
                },
                "ip.dst": {
                    friendlyName: "Dst IP",
                    group: "general",
                    help: "Destination IP",
                    type: "ip",
                    dbField2: "dstIp",
                    portField2: "dstPort",
                    portFieldECS: "destination.port",
                    category: "ip",
                    aliases: ["ip.dst:port"],
                    fieldECS: "destination.ip",
                    dbField: "destination.ip",
                    portField: "destination.port",
                    exp: "ip.dst",
                },
                "destination.ip": {
                    friendlyName: "Dst IP",
                    group: "general",
                    help: "Destination IP",
                    type: "ip",
                    dbField2: "dstIp",
                    portField2: "dstPort",
                    portFieldECS: "destination.port",
                    category: "ip",
                    aliases: ["ip.dst:port"],
                    fieldECS: "destination.ip",
                    dbField: "destination.ip",
                    portField: "destination.port",
                    exp: "ip.dst",
                },
                "ip.dst:port": {
                    friendlyName: "Dst IP",
                    group: "general",
                    help: "Destination IP",
                    type: "ip",
                    dbField2: "dstIp",
                    portField2: "dstPort",
                    portFieldECS: "destination.port",
                    category: "ip",
                    aliases: ["ip.dst:port"],
                    fieldECS: "destination.ip",
                    dbField: "destination.ip",
                    portField: "destination.port",
                    exp: "ip.dst",
                },
                "ip.src": {
                    friendlyName: "Src IP",
                    group: "general",
                    help: "Source IP",
                    type: "ip",
                    dbField2: "srcIp",
                    portField: "source.port",
                    portField2: "srcPort",
                    portFieldECS: "source.port",
                    category: "ip",
                    fieldECS: "source.ip",
                    dbField: "source.ip",
                    exp: "ip.src",
                },
                "source.ip": {
                    friendlyName: "Src IP",
                    group: "general",
                    help: "Source IP",
                    type: "ip",
                    dbField2: "srcIp",
                    portField: "source.port",
                    portField2: "srcPort",
                    portFieldECS: "source.port",
                    category: "ip",
                    fieldECS: "source.ip",
                    dbField: "source.ip",
                    exp: "ip.src",
                },
                "port.dst": {
                    friendlyName: "Dst Port",
                    group: "general",
                    help: "Source Port",
                    type: "integer",
                    dbField2: "dstPort",
                    category: "port",
                    fieldECS: "destination.port",
                    dbField: "destination.port",
                    exp: "port.dst",
                },
                "destination.port": {
                    friendlyName: "Dst Port",
                    group: "general",
                    help: "Source Port",
                    type: "integer",
                    dbField2: "dstPort",
                    category: "port",
                    fieldECS: "destination.port",
                    dbField: "destination.port",
                    exp: "port.dst",
                },
                "asn.src": {
                    friendlyName: "Src ASN",
                    group: "general",
                    help: "GeoIP ASN string calculated from the source IP",
                    type: "termfield",
                    dbField2: "srcASN",
                    category: "asn",
                    fieldECS: "source.as.full",
                    dbField: "source.as.full",
                    exp: "asn.src",
                },
                "source.as.full": {
                    friendlyName: "Src ASN",
                    group: "general",
                    help: "GeoIP ASN string calculated from the source IP",
                    type: "termfield",
                    dbField2: "srcASN",
                    category: "asn",
                    fieldECS: "source.as.full",
                    dbField: "source.as.full",
                    exp: "asn.src",
                },
                "port.src": {
                    friendlyName: "Src Port",
                    group: "general",
                    help: "Source Port",
                    type: "integer",
                    dbField2: "srcPort",
                    category: "port",
                    fieldECS: "source.port",
                    dbField: "source.port",
                    exp: "port.src",
                },
                "source.port": {
                    friendlyName: "Src Port",
                    group: "general",
                    help: "Source Port",
                    type: "integer",
                    dbField2: "srcPort",
                    category: "port",
                    fieldECS: "source.port",
                    dbField: "source.port",
                    exp: "port.src",
                },
                "databytes.dst": {
                    friendlyName: "Dst data bytes",
                    group: "general",
                    help: "Total number of data bytes sent by destination in a session",
                    type: "integer",
                    dbField2: "dstDataBytes",
                    fieldECS: "server.bytes",
                    dbField: "server.bytes",
                    exp: "databytes.dst",
                },
                "server.bytes": {
                    friendlyName: "Dst data bytes",
                    group: "general",
                    help: "Total number of data bytes sent by destination in a session",
                    type: "integer",
                    dbField2: "dstDataBytes",
                    fieldECS: "server.bytes",
                    dbField: "server.bytes",
                    exp: "databytes.dst",
                },
                packets: {
                    friendlyName: "Packets",
                    group: "general",
                    help: "Total number of packets sent AND received in a session",
                    type: "integer",
                    dbField2: "totPackets",
                    fieldECS: "network.packets",
                    dbField: "network.packets",
                    exp: "packets",
                },
                "network.packets": {
                    friendlyName: "Packets",
                    group: "general",
                    help: "Total number of packets sent AND received in a session",
                    type: "integer",
                    dbField2: "totPackets",
                    fieldECS: "network.packets",
                    dbField: "network.packets",
                    exp: "packets",
                },
                "country.dst": {
                    friendlyName: "Dst Country",
                    group: "general",
                    help: "Destination Country",
                    type: "uptermfield",
                    dbField2: "dstGEO",
                    category: "country",
                    fieldECS: "destination.geo.country_iso_code",
                    dbField: "destination.geo.country_iso_code",
                    exp: "country.dst",
                },
                "destination.geo.country_iso_code": {
                    friendlyName: "Dst Country",
                    group: "general",
                    help: "Destination Country",
                    type: "uptermfield",
                    dbField2: "dstGEO",
                    category: "country",
                    fieldECS: "destination.geo.country_iso_code",
                    dbField: "destination.geo.country_iso_code",
                    exp: "country.dst",
                },
                "bytes.src": {
                    friendlyName: "Src Bytes",
                    group: "general",
                    help: "Total number of raw bytes sent by source in a session",
                    type: "integer",
                    dbField2: "srcBytes",
                    fieldECS: "source.bytes",
                    dbField: "source.bytes",
                    exp: "bytes.src",
                },
                "source.bytes": {
                    friendlyName: "Src Bytes",
                    group: "general",
                    help: "Total number of raw bytes sent by source in a session",
                    type: "integer",
                    dbField2: "srcBytes",
                    fieldECS: "source.bytes",
                    dbField: "source.bytes",
                    exp: "bytes.src",
                },
                bytes: {
                    friendlyName: "Bytes",
                    group: "general",
                    help: "Total number of raw bytes sent AND received in a session",
                    type: "integer",
                    dbField2: "totBytes",
                    fieldECS: "network.bytes",
                    dbField: "network.bytes",
                    exp: "bytes",
                },
                "network.bytes": {
                    friendlyName: "Bytes",
                    group: "general",
                    help: "Total number of raw bytes sent AND received in a session",
                    type: "integer",
                    dbField2: "totBytes",
                    fieldECS: "network.bytes",
                    dbField: "network.bytes",
                    exp: "bytes",
                },
                "country.src": {
                    friendlyName: "Src Country",
                    group: "general",
                    help: "Source Country",
                    type: "uptermfield",
                    dbField2: "srcGEO",
                    category: "country",
                    fieldECS: "source.geo.country_iso_code",
                    dbField: "source.geo.country_iso_code",
                    exp: "country.src",
                },
                "source.geo.country_iso_code": {
                    friendlyName: "Src Country",
                    group: "general",
                    help: "Source Country",
                    type: "uptermfield",
                    dbField2: "srcGEO",
                    category: "country",
                    fieldECS: "source.geo.country_iso_code",
                    dbField: "source.geo.country_iso_code",
                    exp: "country.src",
                },
                "asn.dst": {
                    friendlyName: "Dst ASN",
                    group: "general",
                    help: "GeoIP ASN string calculated from the destination IP",
                    type: "termfield",
                    dbField2: "dstASN",
                    category: "asn",
                    fieldECS: "destination.as.full",
                    dbField: "destination.as.full",
                    exp: "asn.dst",
                },
                "destination.as.full": {
                    friendlyName: "Dst ASN",
                    group: "general",
                    help: "GeoIP ASN string calculated from the destination IP",
                    type: "termfield",
                    dbField2: "dstASN",
                    category: "asn",
                    fieldECS: "destination.as.full",
                    dbField: "destination.as.full",
                    exp: "asn.dst",
                },
                "mac.src": {
                    friendlyName: "Src MAC",
                    group: "general",
                    help: "Source ethernet mac addresses set for session",
                    dbField2: "source.mac",
                    type: "lotermfield",
                    transform: "dash2Colon",
                    fieldECS: "source.mac",
                    dbField: "source.mac",
                    exp: "mac.src",
                },
                "source.mac": {
                    friendlyName: "Src MAC",
                    group: "general",
                    help: "Source ethernet mac addresses set for session",
                    dbField2: "source.mac",
                    type: "lotermfield",
                    transform: "dash2Colon",
                    fieldECS: "source.mac",
                    dbField: "source.mac",
                    exp: "mac.src",
                },
                "mac.src.cnt": {
                    friendlyName: "Src MAC Cnt",
                    group: "general",
                    help: "Unique number of Source ethernet mac addresses set for session",
                    dbField2: "source.mac-cnt",
                    type: "integer",
                    dbField: "source.mac-cnt",
                    exp: "mac.src.cnt",
                },
                "mac.dst": {
                    friendlyName: "Dst MAC",
                    group: "general",
                    help: "Destination ethernet mac addresses set for session",
                    dbField2: "destination.mac",
                    type: "lotermfield",
                    transform: "dash2Colon",
                    fieldECS: "destination.mac",
                    dbField: "destination.mac",
                    exp: "mac.dst",
                },
                "destination.mac": {
                    friendlyName: "Dst MAC",
                    group: "general",
                    help: "Destination ethernet mac addresses set for session",
                    dbField2: "destination.mac",
                    type: "lotermfield",
                    transform: "dash2Colon",
                    fieldECS: "destination.mac",
                    dbField: "destination.mac",
                    exp: "mac.dst",
                },
                "mac.dst.cnt": {
                    friendlyName: "Dst MAC Cnt",
                    group: "general",
                    help: "Unique number of Destination ethernet mac addresses set for session",
                    dbField2: "destination.mac-cnt",
                    type: "integer",
                    dbField: "destination.mac-cnt",
                    exp: "mac.dst.cnt",
                },
                "outermac.src": {
                    friendlyName: "Src Outer MAC",
                    group: "general",
                    help: "Source ethernet outer mac addresses set for session",
                    dbField2: "srcOuterMac",
                    type: "lotermfield",
                    transform: "dash2Colon",
                    dbField: "srcOuterMac",
                    exp: "outermac.src",
                },
                "outermac.src.cnt": {
                    friendlyName: "Src Outer MAC Cnt",
                    group: "general",
                    help: "Unique number of Source ethernet outer mac addresses set for session",
                    dbField2: "srcOuterMac-cnt",
                    type: "integer",
                    dbField: "srcOuterMac-cnt",
                    exp: "outermac.src.cnt",
                },
                "outermac.dst": {
                    friendlyName: "Dst Outer MAC",
                    group: "general",
                    help: "Destination ethernet outer mac addresses set for session",
                    dbField2: "dstOuterMac",
                    type: "lotermfield",
                    transform: "dash2Colon",
                    dbField: "dstOuterMac",
                    exp: "outermac.dst",
                },
                "outermac.dst.cnt": {
                    friendlyName: "Dst Outer MAC Cnt",
                    group: "general",
                    help: "Unique number of Destination ethernet outer mac addresses set for session",
                    dbField2: "dstOuterMac-cnt",
                    type: "integer",
                    dbField: "dstOuterMac-cnt",
                    exp: "outermac.dst.cnt",
                },
                "dscp.src": {
                    friendlyName: "Src DSCP",
                    group: "general",
                    help: "Source non zero differentiated services class selector set for session",
                    dbField2: "srcDscp",
                    type: "integer",
                    dbField: "srcDscp",
                    exp: "dscp.src",
                },
                "dscp.src.cnt": {
                    friendlyName: "Src DSCP Cnt",
                    group: "general",
                    help: "Unique number of Source non zero differentiated services class selector set for session",
                    dbField2: "srcDscpCnt",
                    type: "integer",
                    dbField: "srcDscpCnt",
                    exp: "dscp.src.cnt",
                },
                "dscp.dst": {
                    friendlyName: "Dst DSCP",
                    group: "general",
                    help: "Destination non zero differentiated services class selector set for session",
                    dbField2: "dstDscp",
                    type: "integer",
                    dbField: "dstDscp",
                    exp: "dscp.dst",
                },
                "dscp.dst.cnt": {
                    friendlyName: "Dst DSCP Cnt",
                    group: "general",
                    help: "Unique number of Destination non zero differentiated services class selector set for session",
                    dbField2: "dstDscpCnt",
                    type: "integer",
                    dbField: "dstDscpCnt",
                    exp: "dscp.dst.cnt",
                },
                mac: {
                    friendlyName: "Src or Dst MAC",
                    group: "general",
                    help: "Shorthand for mac.src or mac.dst",
                    dbField2: "macall",
                    type: "lotermfield",
                    regex: "^mac\\.(?:(?!\\.cnt$).)*$",
                    transform: "dash2Colon",
                    dbField: "macall",
                    exp: "mac",
                },
                outermac: {
                    friendlyName: "Src or Dst Outer MAC",
                    group: "general",
                    help: "Shorthand for outermac.src or outermac.dst",
                    dbField2: "outermacall",
                    type: "lotermfield",
                    regex: "^outermac\\.(?:(?!\\.cnt$).)*$",
                    transform: "dash2Colon",
                    dbField: "outermacall",
                    exp: "outermac",
                },
                "oui.src": {
                    friendlyName: "Src OUI",
                    group: "general",
                    help: "Source ethernet oui for session",
                    dbField2: "srcOui",
                    type: "termfield",
                    dbField: "srcOui",
                    exp: "oui.src",
                },
                "oui.src.cnt": {
                    friendlyName: "Src OUI Cnt",
                    group: "general",
                    help: "Unique number of Source ethernet oui for session",
                    dbField2: "srcOuiCnt",
                    type: "integer",
                    dbField: "srcOuiCnt",
                    exp: "oui.src.cnt",
                },
                "oui.dst": {
                    friendlyName: "Dst OUI",
                    group: "general",
                    help: "Destination ethernet oui for session",
                    dbField2: "dstOui",
                    type: "termfield",
                    dbField: "dstOui",
                    exp: "oui.dst",
                },
                "oui.dst.cnt": {
                    friendlyName: "Dst OUI Cnt",
                    group: "general",
                    help: "Unique number of Destination ethernet oui for session",
                    dbField2: "dstOuiCnt",
                    type: "integer",
                    dbField: "dstOuiCnt",
                    exp: "oui.dst.cnt",
                },
                "outeroui.src": {
                    friendlyName: "Src Outer OUI",
                    group: "general",
                    help: "Source ethernet outer oui for session",
                    dbField2: "srcOuterOui",
                    type: "termfield",
                    dbField: "srcOuterOui",
                    exp: "outeroui.src",
                },
                "outeroui.src.cnt": {
                    friendlyName: "Src Outer OUI Cnt",
                    group: "general",
                    help: "Unique number of Source ethernet outer oui for session",
                    dbField2: "srcOuterOuiCnt",
                    type: "integer",
                    dbField: "srcOuterOuiCnt",
                    exp: "outeroui.src.cnt",
                },
                "outeroui.dst": {
                    friendlyName: "Dst Outer OUI",
                    group: "general",
                    help: "Destination ethernet outer oui for session",
                    dbField2: "dstOuterOui",
                    type: "termfield",
                    dbField: "dstOuterOui",
                    exp: "outeroui.dst",
                },
                "outeroui.dst.cnt": {
                    friendlyName: "Dst Outer OUI Cnt",
                    group: "general",
                    help: "Unique number of Destination ethernet outer oui for session",
                    dbField2: "dstOuterOuiCnt",
                    type: "integer",
                    dbField: "dstOuterOuiCnt",
                    exp: "outeroui.dst.cnt",
                },
                vlan: {
                    friendlyName: "VLan",
                    group: "general",
                    help: "vlan value",
                    dbField2: "network.vlan.id",
                    type: "integer",
                    dbField: "network.vlan.id",
                    exp: "vlan",
                },
                "vlan.cnt": {
                    friendlyName: "VLan Cnt",
                    group: "general",
                    help: "Unique number of vlan value",
                    dbField2: "network.vlan.id-cnt",
                    type: "integer",
                    dbField: "network.vlan.id-cnt",
                    exp: "vlan.cnt",
                },
                vni: {
                    friendlyName: "VNI",
                    group: "general",
                    help: "vni value",
                    dbField2: "vni",
                    type: "integer",
                    dbField: "vni",
                    exp: "vni",
                },
                "vni.cnt": {
                    friendlyName: "VNI Cnt",
                    group: "general",
                    help: "Unique number of vni value",
                    dbField2: "vniCnt",
                    type: "integer",
                    dbField: "vniCnt",
                    exp: "vni.cnt",
                },
                "outerip.src": {
                    friendlyName: "Src Outer IP",
                    group: "general",
                    help: "Source ethernet outer ip for session",
                    dbField2: "srcOuterIp",
                    type: "ip",
                    dbField: "srcOuterIp",
                    exp: "outerip.src",
                },
                "outerip.src.cnt": {
                    friendlyName: "Src Outer IP Cnt",
                    group: "general",
                    help: "Unique number of Source ethernet outer ip for session",
                    dbField2: "srcOuterIpCnt",
                    type: "integer",
                    dbField: "srcOuterIpCnt",
                    exp: "outerip.src.cnt",
                },
                "outerip.src.country": {
                    friendlyName: "Src Outer IP GEO",
                    group: "general",
                    help: "GeoIP country string calculated from the Source ethernet outer ip for session",
                    dbField2: "srcOuterGEO",
                    type: "uptermfield",
                    dbField: "srcOuterGEO",
                    exp: "outerip.src.country",
                },
                "outerip.src.asn": {
                    friendlyName: "Src Outer IP ASN",
                    group: "general",
                    help: "GeoIP ASN string calculated from the Source ethernet outer ip for session",
                    dbField2: "srcOuterASN",
                    type: "termfield",
                    dbField: "srcOuterASN",
                    exp: "outerip.src.asn",
                },
                "outerip.src.rir": {
                    friendlyName: "Src Outer IP RIR",
                    group: "general",
                    help: "Regional Internet Registry string calculated from Source ethernet outer ip for session",
                    dbField2: "srcOuterRIR",
                    type: "uptermfield",
                    dbField: "srcOuterRIR",
                    exp: "outerip.src.rir",
                },
                "outerip.dst": {
                    friendlyName: "Dst Outer IP",
                    group: "general",
                    help: "Destination outer ip for session",
                    dbField2: "dstOuterIp",
                    type: "ip",
                    dbField: "dstOuterIp",
                    exp: "outerip.dst",
                },
                "outerip.dst.cnt": {
                    friendlyName: "Dst Outer IP Cnt",
                    group: "general",
                    help: "Unique number of Destination outer ip for session",
                    dbField2: "dstOuterIpCnt",
                    type: "integer",
                    dbField: "dstOuterIpCnt",
                    exp: "outerip.dst.cnt",
                },
                "outerip.dst.country": {
                    friendlyName: "Dst Outer IP GEO",
                    group: "general",
                    help: "GeoIP country string calculated from the Destination outer ip for session",
                    dbField2: "dstOuterGEO",
                    type: "uptermfield",
                    dbField: "dstOuterGEO",
                    exp: "outerip.dst.country",
                },
                "outerip.dst.asn": {
                    friendlyName: "Dst Outer IP ASN",
                    group: "general",
                    help: "GeoIP ASN string calculated from the Destination outer ip for session",
                    dbField2: "dstOuterASN",
                    type: "termfield",
                    dbField: "dstOuterASN",
                    exp: "outerip.dst.asn",
                },
                "outerip.dst.rir": {
                    friendlyName: "Dst Outer IP RIR",
                    group: "general",
                    help: "Regional Internet Registry string calculated from Destination outer ip for session",
                    dbField2: "dstOuterRIR",
                    type: "uptermfield",
                    dbField: "dstOuterRIR",
                    exp: "outerip.dst.rir",
                },
                outerip: {
                    friendlyName: "Src or Dst Outer IP",
                    group: "general",
                    help: "Shorthand for outerip.src or outerip.dst",
                    dbField2: "outeripall",
                    type: "lotermfield",
                    regex: "^outerip\\.(?:(?!\\.cnt$).)*$",
                    dbField: "outeripall",
                    exp: "outerip",
                },
                "tcpflags.syn": {
                    friendlyName: "TCP Flag SYN",
                    group: "general",
                    help: "Count of packets with SYN and no ACK flag set",
                    dbField2: "tcpflags.syn",
                    type: "integer",
                    dbField: "tcpflags.syn",
                    exp: "tcpflags.syn",
                },
                "tcpflags.syn-ack": {
                    friendlyName: "TCP Flag SYN-ACK",
                    group: "general",
                    help: "Count of packets with SYN and ACK flag set",
                    dbField2: "tcpflags.syn-ack",
                    type: "integer",
                    dbField: "tcpflags.syn-ack",
                    exp: "tcpflags.syn-ack",
                },
                "tcpflags.ack": {
                    friendlyName: "TCP Flag ACK",
                    group: "general",
                    help: "Count of packets with only the ACK flag set",
                    dbField2: "tcpflags.ack",
                    type: "integer",
                    dbField: "tcpflags.ack",
                    exp: "tcpflags.ack",
                },
                "tcpflags.psh": {
                    friendlyName: "TCP Flag PSH",
                    group: "general",
                    help: "Count of packets with PSH flag set",
                    dbField2: "tcpflags.psh",
                    type: "integer",
                    dbField: "tcpflags.psh",
                    exp: "tcpflags.psh",
                },
                "tcpflags.fin": {
                    friendlyName: "TCP Flag FIN",
                    group: "general",
                    help: "Count of packets with FIN flag set",
                    dbField2: "tcpflags.fin",
                    type: "integer",
                    dbField: "tcpflags.fin",
                    exp: "tcpflags.fin",
                },
                "tcpflags.rst": {
                    friendlyName: "TCP Flag RST",
                    group: "general",
                    help: "Count of packets with RST flag set",
                    dbField2: "tcpflags.rst",
                    type: "integer",
                    dbField: "tcpflags.rst",
                    exp: "tcpflags.rst",
                },
                "tcpflags.urg": {
                    friendlyName: "TCP Flag URG",
                    group: "general",
                    help: "Count of packets with URG flag set",
                    dbField2: "tcpflags.urg",
                    type: "integer",
                    dbField: "tcpflags.urg",
                    exp: "tcpflags.urg",
                },
                initRTT: {
                    friendlyName: "Initial RTT",
                    group: "general",
                    help: "Initial round trip time, difference between SYN and ACK timestamp divided by 2 in ms",
                    dbField2: "initRTT",
                    type: "integer",
                    dbField: "initRTT",
                    exp: "initRTT",
                },
                "session.segments": {
                    friendlyName: "Session Segments",
                    group: "general",
                    help: "Number of segments in session so far",
                    dbField2: "segmentCnt",
                    type: "integer",
                    dbField: "segmentCnt",
                    exp: "session.segments",
                },
                "session.length": {
                    friendlyName: "Session Length",
                    group: "general",
                    help: "Session Length in milliseconds so far",
                    dbField2: "length",
                    type: "integer",
                    dbField: "length",
                    exp: "session.length",
                },
                user: {
                    friendlyName: "User",
                    group: "general",
                    help: "External user set for session",
                    dbField2: "user",
                    type: "lotermfield",
                    category: "user",
                    dbField: "user",
                    exp: "user",
                },
                "user.cnt": {
                    friendlyName: "User Cnt",
                    group: "general",
                    help: "Unique number of External user set for session",
                    dbField2: "userCnt",
                    type: "integer",
                    dbField: "userCnt",
                    exp: "user.cnt",
                },
                "bgp.type": {
                    friendlyName: "Type",
                    group: "bgp",
                    help: "BGP Type field",
                    dbField2: "bgp.type",
                    type: "uptermfield",
                    dbField: "bgp.type",
                    exp: "bgp.type",
                },
                "dhcp.type": {
                    friendlyName: "Type",
                    group: "dhcp",
                    help: "DHCP Type",
                    dbField2: "dhcp.type",
                    type: "uptermfield",
                    dbField: "dhcp.type",
                    exp: "dhcp.type",
                },
                "dhcp.type.cnt": {
                    friendlyName: "Type Cnt",
                    group: "dhcp",
                    help: "Unique number of DHCP Type",
                    dbField2: "dhcp.typeCnt",
                    type: "integer",
                    dbField: "dhcp.typeCnt",
                    exp: "dhcp.type.cnt",
                },
                "dhcp.host": {
                    friendlyName: "Host",
                    group: "dhcp",
                    help: "DHCP Host",
                    dbField2: "dhcp.host",
                    type: "lotermfield",
                    aliases: ["host.dhcp"],
                    category: "host",
                    dbField: "dhcp.host",
                    exp: "dhcp.host",
                },
                "host.dhcp": {
                    friendlyName: "Host",
                    group: "dhcp",
                    help: "DHCP Host",
                    dbField2: "dhcp.host",
                    type: "lotermfield",
                    aliases: ["host.dhcp"],
                    category: "host",
                    dbField: "dhcp.host",
                    exp: "dhcp.host",
                },
                "dhcp.host.cnt": {
                    friendlyName: "Host Cnt",
                    group: "dhcp",
                    help: "Unique number of DHCP Host",
                    dbField2: "dhcp.hostCnt",
                    type: "integer",
                    dbField: "dhcp.hostCnt",
                    exp: "dhcp.host.cnt",
                },
                "dhcp.host.tokens": {
                    friendlyName: "Hostname Tokens",
                    group: "dhcp",
                    help: "DHCP Hostname Tokens",
                    dbField2: "dhcp.hostTokens",
                    type: "lotextfield",
                    aliases: ["host.dhcp.tokens"],
                    dbField: "dhcp.hostTokens",
                    exp: "dhcp.host.tokens",
                },
                "host.dhcp.tokens": {
                    friendlyName: "Hostname Tokens",
                    group: "dhcp",
                    help: "DHCP Hostname Tokens",
                    dbField2: "dhcp.hostTokens",
                    type: "lotextfield",
                    aliases: ["host.dhcp.tokens"],
                    dbField: "dhcp.hostTokens",
                    exp: "dhcp.host.tokens",
                },
                "dhcp.mac": {
                    friendlyName: "Client MAC",
                    group: "dhcp",
                    help: "Client ethernet MAC ",
                    dbField2: "dhcp.mac",
                    type: "lotermfield",
                    dbField: "dhcp.mac",
                    exp: "dhcp.mac",
                },
                "dhcp.mac.cnt": {
                    friendlyName: "Client MAC Cnt",
                    group: "dhcp",
                    help: "Unique number of Client ethernet MAC ",
                    dbField2: "dhcp.macCnt",
                    type: "integer",
                    dbField: "dhcp.macCnt",
                    exp: "dhcp.mac.cnt",
                },
                "dhcp.oui": {
                    friendlyName: "Client OUI",
                    group: "dhcp",
                    help: "Client ethernet OUI ",
                    dbField2: "dhcp.oui",
                    type: "termfield",
                    dbField: "dhcp.oui",
                    exp: "dhcp.oui",
                },
                "dhcp.oui.cnt": {
                    friendlyName: "Client OUI Cnt",
                    group: "dhcp",
                    help: "Unique number of Client ethernet OUI ",
                    dbField2: "dhcp.ouiCnt",
                    type: "integer",
                    dbField: "dhcp.ouiCnt",
                    exp: "dhcp.oui.cnt",
                },
                "dhcp.id": {
                    friendlyName: "Transaction id",
                    group: "dhcp",
                    help: "DHCP Transaction Id",
                    dbField2: "dhcp.id",
                    type: "lotermfield",
                    dbField: "dhcp.id",
                    exp: "dhcp.id",
                },
                "dhcp.id.cnt": {
                    friendlyName: "Transaction id Cnt",
                    group: "dhcp",
                    help: "Unique number of DHCP Transaction Id",
                    dbField2: "dhcp.idCnt",
                    type: "integer",
                    dbField: "dhcp.idCnt",
                    exp: "dhcp.id.cnt",
                },
                "ip.dns": {
                    friendlyName: "IP",
                    group: "dns",
                    help: "IP from DNS result",
                    dbField2: "dns.ip",
                    type: "ip",
                    aliases: ["dns.ip"],
                    category: "ip",
                    dbField: "dns.ip",
                    exp: "ip.dns",
                },
                "dns.ip": {
                    friendlyName: "IP",
                    group: "dns",
                    help: "IP from DNS result",
                    dbField2: "dns.ip",
                    type: "ip",
                    aliases: ["dns.ip"],
                    category: "ip",
                    dbField: "dns.ip",
                    exp: "ip.dns",
                },
                "ip.dns.cnt": {
                    friendlyName: "IP Cnt",
                    group: "dns",
                    help: "Unique number of IP from DNS result",
                    dbField2: "dns.ipCnt",
                    type: "integer",
                    dbField: "dns.ipCnt",
                    exp: "ip.dns.cnt",
                },
                "country.dns": {
                    friendlyName: " GEO",
                    group: "dns",
                    help: "GeoIP country string calculated from the IP from DNS result",
                    dbField2: "dns.GEO",
                    type: "uptermfield",
                    dbField: "dns.GEO",
                    exp: "country.dns",
                },
                "asn.dns": {
                    friendlyName: " ASN",
                    group: "dns",
                    help: "GeoIP ASN string calculated from the IP from DNS result",
                    dbField2: "dns.ASN",
                    type: "termfield",
                    dbField: "dns.ASN",
                    exp: "asn.dns",
                },
                "rir.dns": {
                    friendlyName: " RIR",
                    group: "dns",
                    help: "Regional Internet Registry string calculated from IP from DNS result",
                    dbField2: "dns.RIR",
                    type: "uptermfield",
                    dbField: "dns.RIR",
                    exp: "rir.dns",
                },
                "ip.dns.nameserver": {
                    friendlyName: "IP",
                    group: "dns",
                    help: "IPs for nameservers",
                    dbField2: "dns.nameserverIp",
                    type: "ip",
                    category: "ip",
                    dbField: "dns.nameserverIp",
                    exp: "ip.dns.nameserver",
                },
                "ip.dns.nameserver.cnt": {
                    friendlyName: "IP Cnt",
                    group: "dns",
                    help: "Unique number of IPs for nameservers",
                    dbField2: "dns.nameserverIpCnt",
                    type: "integer",
                    dbField: "dns.nameserverIpCnt",
                    exp: "ip.dns.nameserver.cnt",
                },
                "country.dns.nameserver": {
                    friendlyName: " GEO",
                    group: "dns",
                    help: "GeoIP country string calculated from the IPs for nameservers",
                    dbField2: "dns.nameserverGEO",
                    type: "uptermfield",
                    dbField: "dns.nameserverGEO",
                    exp: "country.dns.nameserver",
                },
                "asn.dns.nameserver": {
                    friendlyName: " ASN",
                    group: "dns",
                    help: "GeoIP ASN string calculated from the IPs for nameservers",
                    dbField2: "dns.nameserverASN",
                    type: "termfield",
                    dbField: "dns.nameserverASN",
                    exp: "asn.dns.nameserver",
                },
                "rir.dns.nameserver": {
                    friendlyName: " RIR",
                    group: "dns",
                    help: "Regional Internet Registry string calculated from IPs for nameservers",
                    dbField2: "dns.nameserverRIR",
                    type: "uptermfield",
                    dbField: "dns.nameserverRIR",
                    exp: "rir.dns.nameserver",
                },
                "ip.dns.mailserver": {
                    friendlyName: "IP",
                    group: "dns",
                    help: "IPs for mailservers",
                    dbField2: "dns.mailserverIp",
                    type: "ip",
                    category: "ip",
                    dbField: "dns.mailserverIp",
                    exp: "ip.dns.mailserver",
                },
                "ip.dns.mailserver.cnt": {
                    friendlyName: "IP Cnt",
                    group: "dns",
                    help: "Unique number of IPs for mailservers",
                    dbField2: "dns.mailserverIpCnt",
                    type: "integer",
                    dbField: "dns.mailserverIpCnt",
                    exp: "ip.dns.mailserver.cnt",
                },
                "country.dns.mailserver": {
                    friendlyName: " GEO",
                    group: "dns",
                    help: "GeoIP country string calculated from the IPs for mailservers",
                    dbField2: "dns.mailserverGEO",
                    type: "uptermfield",
                    dbField: "dns.mailserverGEO",
                    exp: "country.dns.mailserver",
                },
                "asn.dns.mailserver": {
                    friendlyName: " ASN",
                    group: "dns",
                    help: "GeoIP ASN string calculated from the IPs for mailservers",
                    dbField2: "dns.mailserverASN",
                    type: "termfield",
                    dbField: "dns.mailserverASN",
                    exp: "asn.dns.mailserver",
                },
                "rir.dns.mailserver": {
                    friendlyName: " RIR",
                    group: "dns",
                    help: "Regional Internet Registry string calculated from IPs for mailservers",
                    dbField2: "dns.mailserverRIR",
                    type: "uptermfield",
                    dbField: "dns.mailserverRIR",
                    exp: "rir.dns.mailserver",
                },
                "ip.dns.all": {
                    friendlyName: "IP",
                    group: "dns",
                    help: "Shorthand for ip.dns or ip.dns.nameserver",
                    dbField2: "dnsipall",
                    type: "ip",
                    regex: "^ip\\.dns(?:(?!\\.(cnt|all)$).)*$",
                    dbField: "dnsipall",
                    exp: "ip.dns.all",
                },
                "host.dns": {
                    friendlyName: "Host",
                    group: "dns",
                    help: "DNS lookup hostname",
                    dbField2: "dns.host",
                    type: "lotermfield",
                    aliases: ["dns.host"],
                    category: "host",
                    dbField: "dns.host",
                    exp: "host.dns",
                    transform: "removeProtocolAndURI",
                },
                "dns.host": {
                    friendlyName: "Host",
                    group: "dns",
                    help: "DNS lookup hostname",
                    dbField2: "dns.host",
                    type: "lotermfield",
                    aliases: ["dns.host"],
                    category: "host",
                    dbField: "dns.host",
                    exp: "host.dns",
                    transform: "removeProtocolAndURI",
                },
                "host.dns.cnt": {
                    friendlyName: "Host Cnt",
                    group: "dns",
                    help: "Unique number of DNS lookup hostname",
                    dbField2: "dns.hostCnt",
                    type: "integer",
                    dbField: "dns.hostCnt",
                    exp: "host.dns.cnt",
                    transform: "removeProtocolAndURI",
                },
                "host.dns.tokens": {
                    friendlyName: "Hostname Tokens",
                    group: "dns",
                    help: "DNS lookup hostname tokens",
                    dbField2: "dns.hostTokens",
                    type: "lotextfield",
                    aliases: ["dns.host.tokens"],
                    dbField: "dns.hostTokens",
                    exp: "host.dns.tokens",
                    transform: "removeProtocolAndURI",
                },
                "dns.host.tokens": {
                    friendlyName: "Hostname Tokens",
                    group: "dns",
                    help: "DNS lookup hostname tokens",
                    dbField2: "dns.hostTokens",
                    type: "lotextfield",
                    aliases: ["dns.host.tokens"],
                    dbField: "dns.hostTokens",
                    exp: "host.dns.tokens",
                    transform: "removeProtocolAndURI",
                },
                "host.dns.nameserver": {
                    friendlyName: "NS Host",
                    group: "dns",
                    help: "Hostnames for Name Server",
                    dbField2: "dns.nameserverHost",
                    type: "lotermfield",
                    category: "host",
                    dbField: "dns.nameserverHost",
                    exp: "host.dns.nameserver",
                    transform: "removeProtocolAndURI",
                },
                "host.dns.nameserver.cnt": {
                    friendlyName: "NS Host Cnt",
                    group: "dns",
                    help: "Unique number of Hostnames for Name Server",
                    dbField2: "dns.nameserverHostCnt",
                    type: "integer",
                    dbField: "dns.nameserverHostCnt",
                    exp: "host.dns.nameserver.cnt",
                    transform: "removeProtocolAndURI",
                },
                "host.dns.mailserver": {
                    friendlyName: "MX Host",
                    group: "dns",
                    help: "Hostnames for Mail Exchange Server",
                    dbField2: "dns.mailserverHost",
                    type: "lotermfield",
                    category: "host",
                    dbField: "dns.mailserverHost",
                    exp: "host.dns.mailserver",
                    transform: "removeProtocolAndURI",
                },
                "host.dns.mailserver.cnt": {
                    friendlyName: "MX Host Cnt",
                    group: "dns",
                    help: "Unique number of Hostnames for Mail Exchange Server",
                    dbField2: "dns.mailserverHostCnt",
                    type: "integer",
                    dbField: "dns.mailserverHostCnt",
                    exp: "host.dns.mailserver.cnt",
                    transform: "removeProtocolAndURI",
                },
                "host.dns.all": {
                    friendlyName: "All Host",
                    group: "dns",
                    help: "Shorthand for host.dns or host.dns.nameserver",
                    dbField2: "dnshostall",
                    type: "lotermfield",
                    regex: "^host\\.dns(?:(?!\\.(cnt|all)$).)*$",
                    dbField: "dnshostall",
                    exp: "host.dns.all",
                    transform: "removeProtocolAndURI",
                },
                "dns.puny": {
                    friendlyName: "Puny",
                    group: "dns",
                    help: "DNS lookup punycode",
                    dbField2: "dns.puny",
                    type: "lotermfield",
                    dbField: "dns.puny",
                    exp: "dns.puny",
                },
                "dns.puny.cnt": {
                    friendlyName: "Puny Cnt",
                    group: "dns",
                    help: "Unique number of DNS lookup punycode",
                    dbField2: "dns.punyCnt",
                    type: "integer",
                    dbField: "dns.punyCnt",
                    exp: "dns.puny.cnt",
                },
                "dns.status": {
                    friendlyName: "Status Code",
                    group: "dns",
                    help: "DNS lookup return code",
                    dbField2: "dns.status",
                    type: "uptermfield",
                    dbField: "dns.status",
                    exp: "dns.status",
                },
                "dns.status.cnt": {
                    friendlyName: "Status Code Cnt",
                    group: "dns",
                    help: "Unique number of DNS lookup return code",
                    dbField2: "dns.statusCnt",
                    type: "integer",
                    dbField: "dns.statusCnt",
                    exp: "dns.status.cnt",
                },
                "dns.opcode": {
                    friendlyName: "Op Code",
                    group: "dns",
                    help: "DNS lookup op code",
                    dbField2: "dns.opcode",
                    type: "uptermfield",
                    dbField: "dns.opcode",
                    exp: "dns.opcode",
                },
                "dns.opcode.cnt": {
                    friendlyName: "Op Code Cnt",
                    group: "dns",
                    help: "Unique number of DNS lookup op code",
                    dbField2: "dns.opcodeCnt",
                    type: "integer",
                    dbField: "dns.opcodeCnt",
                    exp: "dns.opcode.cnt",
                },
                "dns.query.type": {
                    friendlyName: "Query Type",
                    group: "dns",
                    help: "DNS lookup query type",
                    dbField2: "dns.qt",
                    type: "uptermfield",
                    dbField: "dns.qt",
                    exp: "dns.query.type",
                },
                "dns.query.type.cnt": {
                    friendlyName: "Query Type Cnt",
                    group: "dns",
                    help: "Unique number of DNS lookup query type",
                    dbField2: "dns.qtCnt",
                    type: "integer",
                    dbField: "dns.qtCnt",
                    exp: "dns.query.type.cnt",
                },
                "dns.query.class": {
                    friendlyName: "Query Class",
                    group: "dns",
                    help: "DNS lookup query class",
                    dbField2: "dns.qc",
                    type: "uptermfield",
                    dbField: "dns.qc",
                    exp: "dns.query.class",
                },
                "dns.query.class.cnt": {
                    friendlyName: "Query Class Cnt",
                    group: "dns",
                    help: "Unique number of DNS lookup query class",
                    dbField2: "dns.qcCnt",
                    type: "integer",
                    dbField: "dns.qcCnt",
                    exp: "dns.query.class.cnt",
                },
                "dns.https.alpn": {
                    friendlyName: "Alpn",
                    group: "dns",
                    help: "DNS https alpn",
                    dbField2: "dns.https.alpn",
                    type: "lotermfield",
                    dbField: "dns.https.alpn",
                    exp: "dns.https.alpn",
                },
                "dns.https.alpn.cnt": {
                    friendlyName: "Alpn Cnt",
                    group: "dns",
                    help: "Unique number of DNS https alpn",
                    dbField2: "dns.https.alpnCnt",
                    type: "integer",
                    dbField: "dns.https.alpnCnt",
                    exp: "dns.https.alpn.cnt",
                },
                "ip.dns.https": {
                    friendlyName: "IP",
                    group: "dns",
                    help: "DNS https ip",
                    dbField2: "dns.https.ip",
                    type: "ip",
                    aliases: ["dns.https.ip"],
                    category: "ip",
                    dbField: "dns.https.ip",
                    exp: "ip.dns.https",
                },
                "dns.https.ip": {
                    friendlyName: "IP",
                    group: "dns",
                    help: "DNS https ip",
                    dbField2: "dns.https.ip",
                    type: "ip",
                    aliases: ["dns.https.ip"],
                    category: "ip",
                    dbField: "dns.https.ip",
                    exp: "ip.dns.https",
                },
                "ip.dns.https.cnt": {
                    friendlyName: "IP Cnt",
                    group: "dns",
                    help: "Unique number of DNS https ip",
                    dbField2: "dns.https.ipCnt",
                    type: "integer",
                    dbField: "dns.https.ipCnt",
                    exp: "ip.dns.https.cnt",
                },
                "country.dns.https": {
                    friendlyName: " GEO",
                    group: "dns",
                    help: "GeoIP country string calculated from the DNS https ip",
                    dbField2: "dns.https.GEO",
                    type: "uptermfield",
                    dbField: "dns.https.GEO",
                    exp: "country.dns.https",
                },
                "asn.dns.https": {
                    friendlyName: " ASN",
                    group: "dns",
                    help: "GeoIP ASN string calculated from the DNS https ip",
                    dbField2: "dns.https.ASN",
                    type: "termfield",
                    dbField: "dns.https.ASN",
                    exp: "asn.dns.https",
                },
                "rir.dns.https": {
                    friendlyName: " RIR",
                    group: "dns",
                    help: "Regional Internet Registry string calculated from DNS https ip",
                    dbField2: "dns.https.RIR",
                    type: "uptermfield",
                    dbField: "dns.https.RIR",
                    exp: "rir.dns.https",
                },
                "dns.https.port": {
                    friendlyName: "IP",
                    group: "dns",
                    help: "DNS https port",
                    dbField2: "dns.https.port",
                    type: "integer",
                    dbField: "dns.https.port",
                    exp: "dns.https.port",
                },
                "dns.https.port.cnt": {
                    friendlyName: "IP Cnt",
                    group: "dns",
                    help: "Unique number of DNS https port",
                    dbField2: "dns.https.portCnt",
                    type: "integer",
                    dbField: "dns.https.portCnt",
                    exp: "dns.https.port.cnt",
                },
                "host.http": {
                    friendlyName: "Hostname",
                    group: "http",
                    help: "HTTP host header field",
                    dbField2: "http.host",
                    type: "lotermfield",
                    aliases: ["http.host"],
                    category: "host",
                    dbField: "http.host",
                    exp: "host.http",
                    transform: "removeProtocolAndURI",
                },
                "http.host": {
                    friendlyName: "Hostname",
                    group: "http",
                    help: "HTTP host header field",
                    dbField2: "http.host",
                    type: "lotermfield",
                    aliases: ["http.host"],
                    category: "host",
                    dbField: "http.host",
                    exp: "host.http",
                    transform: "removeProtocolAndURI",
                },
                "host.http.tokens": {
                    friendlyName: "Hostname Tokens",
                    group: "http",
                    help: "HTTP host Tokens header field",
                    dbField2: "http.hostTokens",
                    type: "lotextfield",
                    aliases: ["http.host.tokens"],
                    dbField: "http.hostTokens",
                    exp: "host.http.tokens",
                    transform: "removeProtocolAndURI",
                },
                "http.host.tokens": {
                    friendlyName: "Hostname Tokens",
                    group: "http",
                    help: "HTTP host Tokens header field",
                    dbField2: "http.hostTokens",
                    type: "lotextfield",
                    aliases: ["http.host.tokens"],
                    dbField: "http.hostTokens",
                    exp: "host.http.tokens",
                    transform: "removeProtocolAndURI",
                },
                "http.uri": {
                    friendlyName: "URI",
                    group: "http",
                    help: "URIs for request",
                    dbField2: "http.uri",
                    type: "termfield",
                    category: ["url", "host"],
                    dbField: "http.uri",
                    exp: "http.uri",
                    transform: "removeProtocol",
                },
                "http.uri.cnt": {
                    friendlyName: "URI Cnt",
                    group: "http",
                    help: "Unique number of URIs for request",
                    dbField2: "http.uriCnt",
                    type: "integer",
                    dbField: "http.uriCnt",
                    exp: "http.uri.cnt",
                },
                "http.uri.tokens": {
                    friendlyName: "URI Tokens",
                    group: "http",
                    help: "URIs Tokens for request",
                    dbField2: "http.uriTokens",
                    type: "lotextfield",
                    dbField: "http.uriTokens",
                    exp: "http.uri.tokens",
                    transform: "removeProtocol",
                },
                "ip.xff": {
                    friendlyName: "XFF IP",
                    group: "http",
                    help: "X-Forwarded-For Header",
                    dbField2: "http.xffIp",
                    type: "ip",
                    category: "ip",
                    dbField: "http.xffIp",
                    exp: "ip.xff",
                },
                "ip.xff.cnt": {
                    friendlyName: "XFF IP Cnt",
                    group: "http",
                    help: "Unique number of X-Forwarded-For Header",
                    dbField2: "http.xffIpCnt",
                    type: "integer",
                    dbField: "http.xffIpCnt",
                    exp: "ip.xff.cnt",
                },
                "country.xff": {
                    friendlyName: "XFF  GEO",
                    group: "http",
                    help: "GeoIP country string calculated from the X-Forwarded-For Header",
                    dbField2: "http.xffGEO",
                    type: "uptermfield",
                    dbField: "http.xffGEO",
                    exp: "country.xff",
                },
                "asn.xff": {
                    friendlyName: "XFF  ASN",
                    group: "http",
                    help: "GeoIP ASN string calculated from the X-Forwarded-For Header",
                    dbField2: "http.xffASN",
                    type: "termfield",
                    dbField: "http.xffASN",
                    exp: "asn.xff",
                },
                "rir.xff": {
                    friendlyName: "XFF  RIR",
                    group: "http",
                    help: "Regional Internet Registry string calculated from X-Forwarded-For Header",
                    dbField2: "http.xffRIR",
                    type: "uptermfield",
                    dbField: "http.xffRIR",
                    exp: "rir.xff",
                },
                "http.user-agent": {
                    friendlyName: "Useragent",
                    group: "http",
                    help: "User-Agent Header",
                    dbField2: "http.useragent",
                    type: "termfield",
                    dbField: "http.useragent",
                    exp: "http.user-agent",
                },
                "http.user-agent.cnt": {
                    friendlyName: "Useragent Cnt",
                    group: "http",
                    help: "Unique number of User-Agent Header",
                    dbField2: "http.useragentCnt",
                    type: "integer",
                    dbField: "http.useragentCnt",
                    exp: "http.user-agent.cnt",
                },
                "http.user-agent.tokens": {
                    friendlyName: "Useragent Tokens",
                    group: "http",
                    help: "User-Agent Header Tokens",
                    dbField2: "http.useragentTokens",
                    type: "lotextfield",
                    dbField: "http.useragentTokens",
                    exp: "http.user-agent.tokens",
                },
                "http.hasheader.src": {
                    friendlyName: "Has Src Header",
                    group: "http",
                    help: "Request has header present",
                    dbField2: "http.requestHeader",
                    type: "lotermfield",
                    dbField: "http.requestHeader",
                    exp: "http.hasheader.src",
                },
                "http.hasheader.src.cnt": {
                    friendlyName: "Has Src Header Cnt",
                    group: "http",
                    help: "Unique number of Request has header present",
                    dbField2: "http.requestHeaderCnt",
                    type: "integer",
                    dbField: "http.requestHeaderCnt",
                    exp: "http.hasheader.src.cnt",
                },
                "http.hasheader.dst": {
                    friendlyName: "Has Dst Header",
                    group: "http",
                    help: "Response has header present",
                    dbField2: "http.responseHeader",
                    type: "lotermfield",
                    dbField: "http.responseHeader",
                    exp: "http.hasheader.dst",
                },
                "http.hasheader.dst.cnt": {
                    friendlyName: "Has Dst Header Cnt",
                    group: "http",
                    help: "Unique number of Response has header present",
                    dbField2: "http.responseHeaderCnt",
                    type: "integer",
                    dbField: "http.responseHeaderCnt",
                    exp: "http.hasheader.dst.cnt",
                },
                "http.hasheader.src.value": {
                    friendlyName: "Request Header Values",
                    group: "http",
                    help: "Contains request header values",
                    dbField2: "http.requestHeaderValue",
                    type: "lotermfield",
                    dbField: "http.requestHeaderValue",
                    exp: "http.hasheader.src.value",
                },
                "http.hasheader.src.value.cnt": {
                    friendlyName: "Request Header Values Cnt",
                    group: "http",
                    help: "Unique number of Contains request header values",
                    dbField2: "http.requestHeaderValueCnt",
                    type: "integer",
                    dbField: "http.requestHeaderValueCnt",
                    exp: "http.hasheader.src.value.cnt",
                },
                "http.hasheader.dst.value": {
                    friendlyName: "Response Header Values",
                    group: "http",
                    help: "Contains response header values",
                    dbField2: "http.responseHeaderValue",
                    type: "lotermfield",
                    dbField: "http.responseHeaderValue",
                    exp: "http.hasheader.dst.value",
                },
                "http.hasheader.dst.value.cnt": {
                    friendlyName: "Response Header Values Cnt",
                    group: "http",
                    help: "Unique number of Contains response header values",
                    dbField2: "http.responseHeaderValueCnt",
                    type: "integer",
                    dbField: "http.responseHeaderValueCnt",
                    exp: "http.hasheader.dst.value.cnt",
                },
                "http.hasheader": {
                    friendlyName: "Has Src or Dst Header",
                    group: "http",
                    help: "Shorthand for http.hasheader.src or http.hasheader.dst",
                    dbField2: "hhall",
                    type: "lotermfield",
                    regex: "^http\\.hasheader\\.(?:(?!(cnt|value)$).)*$",
                    dbField: "hhall",
                    exp: "http.hasheader",
                },
                "http.hasheader.value": {
                    friendlyName: "Has Value in Src or Dst Header",
                    group: "http",
                    help: "Shorthand for http.hasheader.src.value or http.hasheader.dst.value",
                    dbField2: "hhvalueall",
                    type: "lotermfield",
                    regex: "^http\\.hasheader\\.(src|dst)\\.value$",
                    dbField: "hhvalueall",
                    exp: "http.hasheader.value",
                },
                "http.md5": {
                    friendlyName: "Body MD5",
                    group: "http",
                    help: "MD5 of http body response",
                    dbField2: "http.md5",
                    type: "lotermfield",
                    category: "md5",
                    dbField: "http.md5",
                    exp: "http.md5",
                },
                "http.version": {
                    friendlyName: "Version",
                    group: "http",
                    help: "HTTP version number",
                    dbField2: "httpversion",
                    type: "termfield",
                    regex: "^http.version.[a-z]+$",
                    dbField: "httpversion",
                    exp: "http.version",
                },
                "http.version.src": {
                    friendlyName: "Src Version",
                    group: "http",
                    help: "Request HTTP version number",
                    dbField2: "http.clientVersion",
                    type: "termfield",
                    dbField: "http.clientVersion",
                    exp: "http.version.src",
                },
                "http.version.src.cnt": {
                    friendlyName: "Src Version Cnt",
                    group: "http",
                    help: "Unique number of Request HTTP version number",
                    dbField2: "http.clientVersionCnt",
                    type: "integer",
                    dbField: "http.clientVersionCnt",
                    exp: "http.version.src.cnt",
                },
                "http.version.dst": {
                    friendlyName: "Dst Version",
                    group: "http",
                    help: "Response HTTP version number",
                    dbField2: "http.serverVersion",
                    type: "termfield",
                    dbField: "http.serverVersion",
                    exp: "http.version.dst",
                },
                "http.version.dst.cnt": {
                    friendlyName: "Dst Version Cnt",
                    group: "http",
                    help: "Unique number of Response HTTP version number",
                    dbField2: "http.serverVersionCnt",
                    type: "integer",
                    dbField: "http.serverVersionCnt",
                    exp: "http.version.dst.cnt",
                },
                "http.uri.path": {
                    friendlyName: "URI Path",
                    group: "http",
                    help: "Path portion of URI",
                    dbField2: "http.path",
                    type: "termfield",
                    dbField: "http.path",
                    exp: "http.uri.path",
                },
                "http.uri.path.cnt": {
                    friendlyName: "URI Path Cnt",
                    group: "http",
                    help: "Unique number of Path portion of URI",
                    dbField2: "http.pathCnt",
                    type: "integer",
                    dbField: "http.pathCnt",
                    exp: "http.uri.path.cnt",
                },
                "http.uri.key": {
                    friendlyName: "QS Keys",
                    group: "http",
                    help: "Keys from query string of URI",
                    dbField2: "http.key",
                    type: "termfield",
                    dbField: "http.key",
                    exp: "http.uri.key",
                },
                "http.uri.key.cnt": {
                    friendlyName: "QS Keys Cnt",
                    group: "http",
                    help: "Unique number of Keys from query string of URI",
                    dbField2: "http.keyCnt",
                    type: "integer",
                    dbField: "http.keyCnt",
                    exp: "http.uri.key.cnt",
                },
                "http.uri.value": {
                    friendlyName: "QS Values",
                    group: "http",
                    help: "Values from query string of URI",
                    dbField2: "http.value",
                    type: "termfield",
                    dbField: "http.value",
                    exp: "http.uri.value",
                },
                "http.uri.value.cnt": {
                    friendlyName: "QS Values Cnt",
                    group: "http",
                    help: "Unique number of Values from query string of URI",
                    dbField2: "http.valueCnt",
                    type: "integer",
                    dbField: "http.valueCnt",
                    exp: "http.uri.value.cnt",
                },
                "http.cookie.key": {
                    friendlyName: "Cookie Keys",
                    group: "http",
                    help: "The keys to cookies sent up in requests",
                    dbField2: "http.cookieKey",
                    type: "termfield",
                    dbField: "http.cookieKey",
                    exp: "http.cookie.key",
                },
                "http.cookie.key.cnt": {
                    friendlyName: "Cookie Keys Cnt",
                    group: "http",
                    help: "Unique number of The keys to cookies sent up in requests",
                    dbField2: "http.cookieKeyCnt",
                    type: "integer",
                    dbField: "http.cookieKeyCnt",
                    exp: "http.cookie.key.cnt",
                },
                "http.cookie.value": {
                    friendlyName: "Cookie Values",
                    group: "http",
                    help: "The values to cookies sent up in requests",
                    dbField2: "http.cookieValue",
                    type: "termfield",
                    dbField: "http.cookieValue",
                    exp: "http.cookie.value",
                },
                "http.cookie.value.cnt": {
                    friendlyName: "Cookie Values Cnt",
                    group: "http",
                    help: "Unique number of The values to cookies sent up in requests",
                    dbField2: "http.cookieValueCnt",
                    type: "integer",
                    dbField: "http.cookieValueCnt",
                    exp: "http.cookie.value.cnt",
                },
                "http.method": {
                    friendlyName: "Request Method",
                    group: "http",
                    help: "HTTP Request Method",
                    dbField2: "http.method",
                    type: "termfield",
                    dbField: "http.method",
                    exp: "http.method",
                },
                "http.bodymagic": {
                    friendlyName: "Body Magic",
                    group: "http",
                    help: "The content type of body determined by libfile/magic",
                    dbField2: "http.bodyMagic",
                    type: "termfield",
                    dbField: "http.bodyMagic",
                    exp: "http.bodymagic",
                },
                "http.user": {
                    friendlyName: "User",
                    group: "http",
                    help: "HTTP Auth User",
                    dbField2: "http.user",
                    type: "termfield",
                    category: "user",
                    dbField: "http.user",
                    exp: "http.user",
                },
                "http.user.cnt": {
                    friendlyName: "User Cnt",
                    group: "http",
                    help: "Unique number of HTTP Auth User",
                    dbField2: "http.userCnt",
                    type: "integer",
                    dbField: "http.userCnt",
                    exp: "http.user.cnt",
                },
                "http.authtype": {
                    friendlyName: "Auth Type",
                    group: "http",
                    help: "HTTP Auth Type",
                    dbField2: "http.authType",
                    type: "lotermfield",
                    dbField: "http.authType",
                    exp: "http.authtype",
                },
                "http.authtype.cnt": {
                    friendlyName: "Auth Type Cnt",
                    group: "http",
                    help: "Unique number of HTTP Auth Type",
                    dbField2: "http.authTypeCnt",
                    type: "integer",
                    dbField: "http.authTypeCnt",
                    exp: "http.authtype.cnt",
                },
                "http.statuscode": {
                    friendlyName: "Status Code",
                    group: "http",
                    help: "Response HTTP numeric status code",
                    dbField2: "http.statuscode",
                    type: "integer",
                    dbField: "http.statuscode",
                    exp: "http.statuscode",
                },
                "http.reqbody": {
                    friendlyName: "Request Body",
                    group: "http",
                    help: "HTTP Request Body",
                    dbField2: "http.requestBody",
                    type: "termfield",
                    dbField: "http.requestBody",
                    exp: "http.reqbody",
                },
                "http.method.DELETE": {
                    friendlyName: "Method DELETE Count",
                    group: "http",
                    help: "Number of DELETE method calls in session",
                    dbField2: "http.method-DELETE",
                    type: "integer",
                    dbField: "http.method-DELETE",
                    exp: "http.method.DELETE",
                },
                "http.method.GET": {
                    friendlyName: "Method GET Count",
                    group: "http",
                    help: "Number of GET method calls in session",
                    dbField2: "http.method-GET",
                    type: "integer",
                    dbField: "http.method-GET",
                    exp: "http.method.GET",
                },
                "http.method.HEAD": {
                    friendlyName: "Method HEAD Count",
                    group: "http",
                    help: "Number of HEAD method calls in session",
                    dbField2: "http.method-HEAD",
                    type: "integer",
                    dbField: "http.method-HEAD",
                    exp: "http.method.HEAD",
                },
                "http.method.POST": {
                    friendlyName: "Method POST Count",
                    group: "http",
                    help: "Number of POST method calls in session",
                    dbField2: "http.method-POST",
                    type: "integer",
                    dbField: "http.method-POST",
                    exp: "http.method.POST",
                },
                "http.method.PUT": {
                    friendlyName: "Method PUT Count",
                    group: "http",
                    help: "Number of PUT method calls in session",
                    dbField2: "http.method-PUT",
                    type: "integer",
                    dbField: "http.method-PUT",
                    exp: "http.method.PUT",
                },
                "http.method.CONNECT": {
                    friendlyName: "Method CONNECT Count",
                    group: "http",
                    help: "Number of CONNECT method calls in session",
                    dbField2: "http.method-CONNECT",
                    type: "integer",
                    dbField: "http.method-CONNECT",
                    exp: "http.method.CONNECT",
                },
                "http.method.OPTIONS": {
                    friendlyName: "Method OPTIONS Count",
                    group: "http",
                    help: "Number of OPTIONS method calls in session",
                    dbField2: "http.method-OPTIONS",
                    type: "integer",
                    dbField: "http.method-OPTIONS",
                    exp: "http.method.OPTIONS",
                },
                "http.request.referer": {
                    friendlyName: "http.request.referer",
                    group: "http",
                    help: "Request header referer",
                    dbField2: "http.request-referer",
                    type: "termfield",
                    aliases: ["http.referer"],
                    dbField: "http.request-referer",
                    exp: "http.request.referer",
                },
                "http.referer": {
                    friendlyName: "http.request.referer",
                    group: "http",
                    help: "Request header referer",
                    dbField2: "http.request-referer",
                    type: "termfield",
                    aliases: ["http.referer"],
                    dbField: "http.request-referer",
                    exp: "http.request.referer",
                },
                "http.request.referer.cnt": {
                    friendlyName: "http.request.referer Cnt",
                    group: "http",
                    help: "Unique number of Request header referer",
                    dbField2: "http.request-refererCnt",
                    type: "integer",
                    dbField: "http.request-refererCnt",
                    exp: "http.request.referer.cnt",
                },
                "http.request.authorization": {
                    friendlyName: "http.request.authorization",
                    group: "http",
                    help: "Request header authorization",
                    dbField2: "http.request-authorization",
                    type: "termfield",
                    aliases: ["http.authorization"],
                    dbField: "http.request-authorization",
                    exp: "http.request.authorization",
                },
                "http.authorization": {
                    friendlyName: "http.request.authorization",
                    group: "http",
                    help: "Request header authorization",
                    dbField2: "http.request-authorization",
                    type: "termfield",
                    aliases: ["http.authorization"],
                    dbField: "http.request-authorization",
                    exp: "http.request.authorization",
                },
                "http.request.authorization.cnt": {
                    friendlyName: "http.request.authorization Cnt",
                    group: "http",
                    help: "Unique number of Request header authorization",
                    dbField2: "http.request-authorizationCnt",
                    type: "integer",
                    dbField: "http.request-authorizationCnt",
                    exp: "http.request.authorization.cnt",
                },
                "http.request.content-type": {
                    friendlyName: "http.request.content-type",
                    group: "http",
                    help: "Request header content-type",
                    dbField2: "http.request-content-type",
                    type: "termfield",
                    aliases: ["http.content-type"],
                    dbField: "http.request-content-type",
                    exp: "http.request.content-type",
                },
                "http.content-type": {
                    friendlyName: "http.response.content-type",
                    group: "http",
                    help: "Response header content-type",
                    dbField2: "http.response-content-type",
                    type: "termfield",
                    aliases: ["http.content-type"],
                    dbField: "http.response-content-type",
                    exp: "http.response.content-type",
                },
                "http.request.content-type.cnt": {
                    friendlyName: "http.request.content-type Cnt",
                    group: "http",
                    help: "Unique number of Request header content-type",
                    dbField2: "http.request-content-typeCnt",
                    type: "integer",
                    dbField: "http.request-content-typeCnt",
                    exp: "http.request.content-type.cnt",
                },
                "http.request.origin": {
                    friendlyName: "http.request.origin",
                    group: "http",
                    help: "Request header origin",
                    dbField2: "http.request-origin",
                    type: "termfield",
                    aliases: ["http.origin"],
                    dbField: "http.request-origin",
                    exp: "http.request.origin",
                },
                "http.origin": {
                    friendlyName: "http.request.origin",
                    group: "http",
                    help: "Request header origin",
                    dbField2: "http.request-origin",
                    type: "termfield",
                    aliases: ["http.origin"],
                    dbField: "http.request-origin",
                    exp: "http.request.origin",
                },
                "http.response.location": {
                    friendlyName: "http.response.location",
                    group: "http",
                    help: "Response header location",
                    dbField2: "http.response-location",
                    type: "termfield",
                    aliases: ["http.location"],
                    dbField: "http.response-location",
                    exp: "http.response.location",
                },
                "http.location": {
                    friendlyName: "http.response.location",
                    group: "http",
                    help: "Response header location",
                    dbField2: "http.response-location",
                    type: "termfield",
                    aliases: ["http.location"],
                    dbField: "http.response-location",
                    exp: "http.response.location",
                },
                "http.response.server": {
                    friendlyName: "http.response.server",
                    group: "http",
                    help: "Response header server",
                    dbField2: "http.response-server",
                    type: "termfield",
                    aliases: ["http.server"],
                    dbField: "http.response-server",
                    exp: "http.response.server",
                },
                "http.server": {
                    friendlyName: "http.response.server",
                    group: "http",
                    help: "Response header server",
                    dbField2: "http.response-server",
                    type: "termfield",
                    aliases: ["http.server"],
                    dbField: "http.response-server",
                    exp: "http.response.server",
                },
                "http.response.content-type": {
                    friendlyName: "http.response.content-type",
                    group: "http",
                    help: "Response header content-type",
                    dbField2: "http.response-content-type",
                    type: "termfield",
                    aliases: ["http.content-type"],
                    dbField: "http.response-content-type",
                    exp: "http.response.content-type",
                },
                "http.response.content-type.cnt": {
                    friendlyName: "http.response.content-type Cnt",
                    group: "http",
                    help: "Unique number of Response header content-type",
                    dbField2: "http.response-content-typeCnt",
                    type: "integer",
                    dbField: "http.response-content-typeCnt",
                    exp: "http.response.content-type.cnt",
                },
                "http.method.cnt": {
                    friendlyName: "Request Method Cnt",
                    group: "http",
                    help: "Unique number of HTTP Request Method",
                    dbField2: "http.methodCnt",
                    type: "integer",
                    dbField: "http.methodCnt",
                    exp: "http.method.cnt",
                },
                "http.statuscode.cnt": {
                    friendlyName: "Status Code Cnt",
                    group: "http",
                    help: "Unique number of Response HTTP numeric status code",
                    dbField2: "http.statuscodeCnt",
                    type: "integer",
                    dbField: "http.statuscodeCnt",
                    exp: "http.statuscode.cnt",
                },
                "host.http.cnt": {
                    friendlyName: "Hostname Cnt",
                    group: "http",
                    help: "Unique number of HTTP host header field",
                    dbField2: "http.hostCnt",
                    type: "integer",
                    dbField: "http.hostCnt",
                    exp: "host.http.cnt",
                    transform: "removeProtocolAndURI",
                },
                "http.bodymagic.cnt": {
                    friendlyName: "Body Magic Cnt",
                    group: "http",
                    help: "Unique number of The content type of body determined by libfile/magic",
                    dbField2: "http.bodyMagicCnt",
                    type: "integer",
                    dbField: "http.bodyMagicCnt",
                    exp: "http.bodymagic.cnt",
                },
                "http.md5.cnt": {
                    friendlyName: "Body MD5 Cnt",
                    group: "http",
                    help: "Unique number of MD5 of http body response",
                    dbField2: "http.md5Cnt",
                    type: "integer",
                    dbField: "http.md5Cnt",
                    exp: "http.md5.cnt",
                },
                "icmp.type": {
                    friendlyName: "ICMP Type",
                    group: "general",
                    help: "ICMP type field values",
                    dbField2: "icmp.type",
                    type: "integer",
                    dbField: "icmp.type",
                    exp: "icmp.type",
                },
                "icmp.code": {
                    friendlyName: "ICMP Code",
                    group: "general",
                    help: "ICMP code field values",
                    dbField2: "icmp.code",
                    type: "integer",
                    dbField: "icmp.code",
                    exp: "icmp.code",
                },
                "irc.nick": {
                    friendlyName: "Nickname",
                    group: "irc",
                    help: "Nicknames set",
                    dbField2: "irc.nick",
                    type: "termfield",
                    category: "user",
                    dbField: "irc.nick",
                    exp: "irc.nick",
                },
                "irc.nick.cnt": {
                    friendlyName: "Nickname Cnt",
                    group: "irc",
                    help: "Unique number of Nicknames set",
                    dbField2: "irc.nickCnt",
                    type: "integer",
                    dbField: "irc.nickCnt",
                    exp: "irc.nick.cnt",
                },
                "irc.channel": {
                    friendlyName: "Channel",
                    group: "irc",
                    help: "Channels joined",
                    dbField2: "irc.channel",
                    type: "termfield",
                    dbField: "irc.channel",
                    exp: "irc.channel",
                },
                "irc.channel.cnt": {
                    friendlyName: "Channel Cnt",
                    group: "irc",
                    help: "Unique number of Channels joined",
                    dbField2: "irc.channelCnt",
                    type: "integer",
                    dbField: "irc.channelCnt",
                    exp: "irc.channel.cnt",
                },
                "isis.msgType": {
                    friendlyName: "isis.msgType",
                    group: "isis",
                    help: "ISIS Msg Type field",
                    dbField2: "isis.msgType",
                    type: "lotermfield",
                    dbField: "isis.msgType",
                    exp: "isis.msgType",
                },
                "krb5.realm": {
                    friendlyName: "Realm",
                    group: "krb5",
                    help: "Kerberos 5 Realm",
                    dbField2: "krb5.realm",
                    type: "termfield",
                    dbField: "krb5.realm",
                    exp: "krb5.realm",
                },
                "krb5.realm.cnt": {
                    friendlyName: "Realm Cnt",
                    group: "krb5",
                    help: "Unique number of Kerberos 5 Realm",
                    dbField2: "krb5.realmCnt",
                    type: "integer",
                    dbField: "krb5.realmCnt",
                    exp: "krb5.realm.cnt",
                },
                "krb5.cname": {
                    friendlyName: "cname",
                    group: "krb5",
                    help: "Kerberos 5 cname",
                    dbField2: "krb5.cname",
                    type: "termfield",
                    dbField: "krb5.cname",
                    exp: "krb5.cname",
                },
                "krb5.cname.cnt": {
                    friendlyName: "cname Cnt",
                    group: "krb5",
                    help: "Unique number of Kerberos 5 cname",
                    dbField2: "krb5.cnameCnt",
                    type: "integer",
                    dbField: "krb5.cnameCnt",
                    exp: "krb5.cname.cnt",
                },
                "krb5.sname": {
                    friendlyName: "sname",
                    group: "krb5",
                    help: "Kerberos 5 sname",
                    dbField2: "krb5.sname",
                    type: "termfield",
                    dbField: "krb5.sname",
                    exp: "krb5.sname",
                },
                "krb5.sname.cnt": {
                    friendlyName: "sname Cnt",
                    group: "krb5",
                    help: "Unique number of Kerberos 5 sname",
                    dbField2: "krb5.snameCnt",
                    type: "integer",
                    dbField: "krb5.snameCnt",
                    exp: "krb5.sname.cnt",
                },
                "ldap.authtype": {
                    friendlyName: "Auth Type",
                    group: "ldap",
                    help: "The auth type of ldap bind",
                    dbField2: "ldap.authtype",
                    type: "termfield",
                    dbField: "ldap.authtype",
                    exp: "ldap.authtype",
                },
                "ldap.authtype.cnt": {
                    friendlyName: "Auth Type Cnt",
                    group: "ldap",
                    help: "Unique number of The auth type of ldap bind",
                    dbField2: "ldap.authtypeCnt",
                    type: "integer",
                    dbField: "ldap.authtypeCnt",
                    exp: "ldap.authtype.cnt",
                },
                "ldap.bindname": {
                    friendlyName: "Bind Name",
                    group: "ldap",
                    help: "The bind name of ldap bind",
                    dbField2: "ldap.bindname",
                    type: "termfield",
                    dbField: "ldap.bindname",
                    exp: "ldap.bindname",
                },
                "ldap.bindname.cnt": {
                    friendlyName: "Bind Name Cnt",
                    group: "ldap",
                    help: "Unique number of The bind name of ldap bind",
                    dbField2: "ldap.bindnameCnt",
                    type: "integer",
                    dbField: "ldap.bindnameCnt",
                    exp: "ldap.bindname.cnt",
                },
                "modbus.unitid": {
                    friendlyName: "Modbus Unit ID",
                    group: "modbus",
                    help: "Modbus Unit ID",
                    dbField2: "modbus.unitid",
                    type: "integer",
                    dbField: "modbus.unitid",
                    exp: "modbus.unitid",
                },
                "modbus.transactionid": {
                    friendlyName: "Modbus Transaction IDs",
                    group: "modbus",
                    help: "Modbus Transaction IDs",
                    dbField2: "modbus.transactionid",
                    type: "integer",
                    dbField: "modbus.transactionid",
                    exp: "modbus.transactionid",
                },
                "modbus.transactionid.cnt": {
                    friendlyName: "Modbus Transaction IDs Cnt",
                    group: "modbus",
                    help: "Unique number of Modbus Transaction IDs",
                    dbField2: "modbus.transactionidCnt",
                    type: "integer",
                    dbField: "modbus.transactionidCnt",
                    exp: "modbus.transactionid.cnt",
                },
                "modbus.protocolid": {
                    friendlyName: "Modbus Protocol ID",
                    group: "modbus",
                    help: "Modbus Protocol ID (should always be 0)",
                    dbField2: "modbus.protocolid",
                    type: "integer",
                    dbField: "modbus.protocolid",
                    exp: "modbus.protocolid",
                },
                "modbus.funccode": {
                    friendlyName: "Modbus Function Code",
                    group: "modbus",
                    help: "Modbus Function Codes",
                    dbField2: "modbus.funccode",
                    type: "integer",
                    dbField: "modbus.funccode",
                    exp: "modbus.funccode",
                },
                "modbus.funccode.cnt": {
                    friendlyName: "Modbus Function Code Cnt",
                    group: "modbus",
                    help: "Unique number of Modbus Function Codes",
                    dbField2: "modbus.funccodeCnt",
                    type: "integer",
                    dbField: "modbus.funccodeCnt",
                    exp: "modbus.funccode.cnt",
                },
                "modbus.exccode": {
                    friendlyName: "Modbus Exception Code",
                    group: "modbus",
                    help: "Modbus Exception Codes",
                    dbField2: "modbus.exccode",
                    type: "integer",
                    dbField: "modbus.exccode",
                    exp: "modbus.exccode",
                },
                "modbus.exccode.cnt": {
                    friendlyName: "Modbus Exception Code Cnt",
                    group: "modbus",
                    help: "Unique number of Modbus Exception Codes",
                    dbField2: "modbus.exccodeCnt",
                    type: "integer",
                    dbField: "modbus.exccodeCnt",
                    exp: "modbus.exccode.cnt",
                },
                "mysql.user": {
                    friendlyName: "User",
                    group: "mysql",
                    help: "Mysql user name",
                    dbField2: "mysql.user",
                    type: "lotermfield",
                    category: "user",
                    dbField: "mysql.user",
                    exp: "mysql.user",
                },
                "mysql.ver": {
                    friendlyName: "Version",
                    group: "mysql",
                    help: "Mysql server version string",
                    dbField2: "mysql.version",
                    type: "termfield",
                    dbField: "mysql.version",
                    exp: "mysql.ver",
                },
                "oracle.user": {
                    friendlyName: "User",
                    group: "oracle",
                    help: "Oracle User",
                    dbField2: "oracle.user",
                    type: "lotermfield",
                    category: "user",
                    dbField: "oracle.user",
                    exp: "oracle.user",
                },
                "oracle.host": {
                    friendlyName: "Host",
                    group: "oracle",
                    help: "Oracle Host",
                    dbField2: "oracle.host",
                    type: "lotermfield",
                    category: "host",
                    aliases: ["host.oracle"],
                    dbField: "oracle.host",
                    exp: "oracle.host",
                },
                "host.oracle": {
                    friendlyName: "Host",
                    group: "oracle",
                    help: "Oracle Host",
                    dbField2: "oracle.host",
                    type: "lotermfield",
                    category: "host",
                    aliases: ["host.oracle"],
                    dbField: "oracle.host",
                    exp: "oracle.host",
                },
                "oracle.host.tokens": {
                    friendlyName: "Hostname Tokens",
                    group: "oracle",
                    help: "Oracle Hostname Tokens",
                    dbField2: "oracle.hostTokens",
                    type: "lotextfield",
                    aliases: ["host.oracle.tokens"],
                    dbField: "oracle.hostTokens",
                    exp: "oracle.host.tokens",
                },
                "host.oracle.tokens": {
                    friendlyName: "Hostname Tokens",
                    group: "oracle",
                    help: "Oracle Hostname Tokens",
                    dbField2: "oracle.hostTokens",
                    type: "lotextfield",
                    aliases: ["host.oracle.tokens"],
                    dbField: "oracle.hostTokens",
                    exp: "oracle.host.tokens",
                },
                "oracle.service": {
                    friendlyName: "Service",
                    group: "oracle",
                    help: "Oracle Service",
                    dbField2: "oracle.service",
                    type: "lotermfield",
                    dbField: "oracle.service",
                    exp: "oracle.service",
                },
                "postgresql.user": {
                    friendlyName: "User",
                    group: "postgresql",
                    help: "Postgresql user name",
                    dbField2: "postgresql.user",
                    type: "termfield",
                    category: "user",
                    dbField: "postgresql.user",
                    exp: "postgresql.user",
                },
                "postgresql.db": {
                    friendlyName: "Database",
                    group: "postgresql",
                    help: "Postgresql database",
                    dbField2: "postgresql.db",
                    type: "termfield",
                    dbField: "postgresql.db",
                    exp: "postgresql.db",
                },
                "postgresql.app": {
                    friendlyName: "Application",
                    group: "postgresql",
                    help: "Postgresql application",
                    dbField2: "postgresql.app",
                    type: "termfield",
                    dbField: "postgresql.app",
                    exp: "postgresql.app",
                },
                "host.quic": {
                    friendlyName: "Hostname",
                    group: "quic",
                    help: "QUIC host header field",
                    dbField2: "quic.host",
                    type: "lotermfield",
                    category: "host",
                    aliases: ["quic.host"],
                    dbField: "quic.host",
                    exp: "host.quic",
                    transform: "removeProtocolAndURI",
                },
                "quic.host": {
                    friendlyName: "Hostname",
                    group: "quic",
                    help: "QUIC host header field",
                    dbField2: "quic.host",
                    type: "lotermfield",
                    category: "host",
                    aliases: ["quic.host"],
                    dbField: "quic.host",
                    exp: "host.quic",
                    transform: "removeProtocolAndURI",
                },
                "host.quic.cnt": {
                    friendlyName: "Hostname Cnt",
                    group: "quic",
                    help: "Unique number of QUIC host header field",
                    dbField2: "quic.hostCnt",
                    type: "integer",
                    dbField: "quic.hostCnt",
                    exp: "host.quic.cnt",
                    transform: "removeProtocolAndURI",
                },
                "host.quic.tokens": {
                    friendlyName: "Hostname Tokens",
                    group: "quic",
                    help: "QUIC host tokens header field",
                    dbField2: "quic.hostTokens",
                    type: "lotextfield",
                    aliases: ["quic.host.tokens"],
                    dbField: "quic.hostTokens",
                    exp: "host.quic.tokens",
                    transform: "removeProtocolAndURI",
                },
                "quic.host.tokens": {
                    friendlyName: "Hostname Tokens",
                    group: "quic",
                    help: "QUIC host tokens header field",
                    dbField2: "quic.hostTokens",
                    type: "lotextfield",
                    aliases: ["quic.host.tokens"],
                    dbField: "quic.hostTokens",
                    exp: "host.quic.tokens",
                    transform: "removeProtocolAndURI",
                },
                "quic.user-agent": {
                    friendlyName: "User-Agent",
                    group: "quic",
                    help: "User-Agent",
                    dbField2: "quic.useragent",
                    type: "termfield",
                    dbField: "quic.useragent",
                    exp: "quic.user-agent",
                },
                "quic.user-agent.cnt": {
                    friendlyName: "User-Agent Cnt",
                    group: "quic",
                    help: "Unique number of User-Agent",
                    dbField2: "quic.useragentCnt",
                    type: "integer",
                    dbField: "quic.useragentCnt",
                    exp: "quic.user-agent.cnt",
                },
                "quic.version": {
                    friendlyName: "Version",
                    group: "quic",
                    help: "QUIC Version",
                    dbField2: "quic.version",
                    type: "termfield",
                    dbField: "quic.version",
                    exp: "quic.version",
                },
                "quic.version.cnt": {
                    friendlyName: "Version Cnt",
                    group: "quic",
                    help: "Unique number of QUIC Version",
                    dbField2: "quic.versionCnt",
                    type: "integer",
                    dbField: "quic.versionCnt",
                    exp: "quic.version.cnt",
                },
                "radius.user": {
                    friendlyName: "User",
                    group: "radius",
                    help: "RADIUS user",
                    dbField2: "radius.user",
                    type: "termfield",
                    category: "user",
                    dbField: "radius.user",
                    exp: "radius.user",
                },
                "radius.mac": {
                    friendlyName: "MAC",
                    group: "radius",
                    help: "Radius Mac",
                    dbField2: "radius.mac",
                    type: "lotermfield",
                    dbField: "radius.mac",
                    exp: "radius.mac",
                },
                "radius.mac.cnt": {
                    friendlyName: "MAC Cnt",
                    group: "radius",
                    help: "Unique number of Radius Mac",
                    dbField2: "radius.macCnt",
                    type: "integer",
                    dbField: "radius.macCnt",
                    exp: "radius.mac.cnt",
                },
                "radius.endpoint-ip": {
                    friendlyName: "Endpoint IP",
                    group: "radius",
                    help: "Radius endpoint ip addresses for session",
                    dbField2: "radius.endpointIp",
                    type: "ip",
                    dbField: "radius.endpointIp",
                    exp: "radius.endpoint-ip",
                },
                "radius.endpoint-ip.cnt": {
                    friendlyName: "Endpoint IP Cnt",
                    group: "radius",
                    help: "Unique number of Radius endpoint ip addresses for session",
                    dbField2: "radius.endpointIpCnt",
                    type: "integer",
                    dbField: "radius.endpointIpCnt",
                    exp: "radius.endpoint-ip.cnt",
                },
                "radius.endpoint-ip.country": {
                    friendlyName: "Endpoint IP GEO",
                    group: "radius",
                    help: "GeoIP country string calculated from the Radius endpoint ip addresses for session",
                    dbField2: "radius.endpointGEO",
                    type: "uptermfield",
                    dbField: "radius.endpointGEO",
                    exp: "radius.endpoint-ip.country",
                },
                "radius.endpoint-ip.asn": {
                    friendlyName: "Endpoint IP ASN",
                    group: "radius",
                    help: "GeoIP ASN string calculated from the Radius endpoint ip addresses for session",
                    dbField2: "radius.endpointASN",
                    type: "termfield",
                    dbField: "radius.endpointASN",
                    exp: "radius.endpoint-ip.asn",
                },
                "radius.endpoint-ip.rir": {
                    friendlyName: "Endpoint IP RIR",
                    group: "radius",
                    help: "Regional Internet Registry string calculated from Radius endpoint ip addresses for session",
                    dbField2: "radius.endpointRIR",
                    type: "uptermfield",
                    dbField: "radius.endpointRIR",
                    exp: "radius.endpoint-ip.rir",
                },
                "radius.framed-ip": {
                    friendlyName: "Framed IP",
                    group: "radius",
                    help: "Radius framed ip addresses for session",
                    dbField2: "radius.framedIp",
                    type: "ip",
                    dbField: "radius.framedIp",
                    exp: "radius.framed-ip",
                },
                "radius.framed-ip.cnt": {
                    friendlyName: "Framed IP Cnt",
                    group: "radius",
                    help: "Unique number of Radius framed ip addresses for session",
                    dbField2: "radius.framedIpCnt",
                    type: "integer",
                    dbField: "radius.framedIpCnt",
                    exp: "radius.framed-ip.cnt",
                },
                "radius.framed-ip.country": {
                    friendlyName: "Framed IP GEO",
                    group: "radius",
                    help: "GeoIP country string calculated from the Radius framed ip addresses for session",
                    dbField2: "radius.framedGEO",
                    type: "uptermfield",
                    dbField: "radius.framedGEO",
                    exp: "radius.framed-ip.country",
                },
                "radius.framed-ip.asn": {
                    friendlyName: "Framed IP ASN",
                    group: "radius",
                    help: "GeoIP ASN string calculated from the Radius framed ip addresses for session",
                    dbField2: "radius.framedASN",
                    type: "termfield",
                    dbField: "radius.framedASN",
                    exp: "radius.framed-ip.asn",
                },
                "radius.framed-ip.rir": {
                    friendlyName: "Framed IP RIR",
                    group: "radius",
                    help: "Regional Internet Registry string calculated from Radius framed ip addresses for session",
                    dbField2: "radius.framedRIR",
                    type: "uptermfield",
                    dbField: "radius.framedRIR",
                    exp: "radius.framed-ip.rir",
                },
                "smb.share": {
                    friendlyName: "Share",
                    group: "smb",
                    help: "SMB shares connected to",
                    dbField2: "smb.share",
                    type: "termfield",
                    dbField: "smb.share",
                    exp: "smb.share",
                },
                "smb.share.cnt": {
                    friendlyName: "Share Cnt",
                    group: "smb",
                    help: "Unique number of SMB shares connected to",
                    dbField2: "smb.shareCnt",
                    type: "integer",
                    dbField: "smb.shareCnt",
                    exp: "smb.share.cnt",
                },
                "smb.fn": {
                    friendlyName: "Filename",
                    group: "smb",
                    help: "SMB files opened, created, deleted",
                    dbField2: "smb.filename",
                    type: "termfield",
                    dbField: "smb.filename",
                    exp: "smb.fn",
                },
                "smb.fn.cnt": {
                    friendlyName: "Filename Cnt",
                    group: "smb",
                    help: "Unique number of SMB files opened, created, deleted",
                    dbField2: "smb.filenameCnt",
                    type: "integer",
                    dbField: "smb.filenameCnt",
                    exp: "smb.fn.cnt",
                },
                "smb.os": {
                    friendlyName: "OS",
                    group: "smb",
                    help: "SMB OS information",
                    dbField2: "smb.os",
                    type: "termfield",
                    dbField: "smb.os",
                    exp: "smb.os",
                },
                "smb.os.cnt": {
                    friendlyName: "OS Cnt",
                    group: "smb",
                    help: "Unique number of SMB OS information",
                    dbField2: "smb.osCnt",
                    type: "integer",
                    dbField: "smb.osCnt",
                    exp: "smb.os.cnt",
                },
                "smb.domain": {
                    friendlyName: "Domain",
                    group: "smb",
                    help: "SMB domain",
                    dbField2: "smb.domain",
                    type: "termfield",
                    dbField: "smb.domain",
                    exp: "smb.domain",
                },
                "smb.domain.cnt": {
                    friendlyName: "Domain Cnt",
                    group: "smb",
                    help: "Unique number of SMB domain",
                    dbField2: "smb.domainCnt",
                    type: "integer",
                    dbField: "smb.domainCnt",
                    exp: "smb.domain.cnt",
                },
                "smb.ver": {
                    friendlyName: "Version",
                    group: "smb",
                    help: "SMB Version information",
                    dbField2: "smb.version",
                    type: "termfield",
                    dbField: "smb.version",
                    exp: "smb.ver",
                },
                "smb.ver.cnt": {
                    friendlyName: "Version Cnt",
                    group: "smb",
                    help: "Unique number of SMB Version information",
                    dbField2: "smb.versionCnt",
                    type: "integer",
                    dbField: "smb.versionCnt",
                    exp: "smb.ver.cnt",
                },
                "smb.user": {
                    friendlyName: "User",
                    group: "smb",
                    help: "SMB User",
                    dbField2: "smb.user",
                    type: "termfield",
                    category: "user",
                    dbField: "smb.user",
                    exp: "smb.user",
                },
                "smb.user.cnt": {
                    friendlyName: "User Cnt",
                    group: "smb",
                    help: "Unique number of SMB User",
                    dbField2: "smb.userCnt",
                    type: "integer",
                    dbField: "smb.userCnt",
                    exp: "smb.user.cnt",
                },
                "host.smb": {
                    friendlyName: "Hostname",
                    group: "smb",
                    help: "SMB Host name",
                    dbField2: "smb.host",
                    type: "termfield",
                    category: "host",
                    aliases: ["smb.host"],
                    dbField: "smb.host",
                    exp: "host.smb",
                    transform: "removeProtocolAndURI",
                },
                "smb.host": {
                    friendlyName: "Hostname",
                    group: "smb",
                    help: "SMB Host name",
                    dbField2: "smb.host",
                    type: "termfield",
                    category: "host",
                    aliases: ["smb.host"],
                    dbField: "smb.host",
                    exp: "host.smb",
                    transform: "removeProtocolAndURI",
                },
                "host.smb.cnt": {
                    friendlyName: "Hostname Cnt",
                    group: "smb",
                    help: "Unique number of SMB Host name",
                    dbField2: "smb.hostCnt",
                    type: "integer",
                    dbField: "smb.hostCnt",
                    exp: "host.smb.cnt",
                    transform: "removeProtocolAndURI",
                },
                "host.smb.tokens": {
                    friendlyName: "Hostname Tokens",
                    group: "smb",
                    help: "SMB Host Tokens",
                    dbField2: "smb.hostTokens",
                    type: "lotextfield",
                    aliases: ["smb.host.tokens"],
                    dbField: "smb.hostTokens",
                    exp: "host.smb.tokens",
                    transform: "removeProtocolAndURI",
                },
                "smb.host.tokens": {
                    friendlyName: "Hostname Tokens",
                    group: "smb",
                    help: "SMB Host Tokens",
                    dbField2: "smb.hostTokens",
                    type: "lotextfield",
                    aliases: ["smb.host.tokens"],
                    dbField: "smb.hostTokens",
                    exp: "host.smb.tokens",
                    transform: "removeProtocolAndURI",
                },
                "host.email": {
                    friendlyName: "Hostname",
                    group: "email",
                    help: "Email hostnames",
                    dbField2: "email.host",
                    type: "lotermfield",
                    aliases: ["email.host"],
                    requiredRight: "emailSearch",
                    category: "host",
                    dbField: "email.host",
                    exp: "host.email",
                    transform: "removeProtocolAndURI",
                },
                "email.host": {
                    friendlyName: "Hostname",
                    group: "email",
                    help: "Email hostnames",
                    dbField2: "email.host",
                    type: "lotermfield",
                    aliases: ["email.host"],
                    requiredRight: "emailSearch",
                    category: "host",
                    dbField: "email.host",
                    exp: "host.email",
                    transform: "removeProtocolAndURI",
                },
                "host.email.cnt": {
                    friendlyName: "Hostname Cnt",
                    group: "email",
                    help: "Unique number of Email hostnames",
                    dbField2: "email.hostCnt",
                    type: "integer",
                    dbField: "email.hostCnt",
                    exp: "host.email.cnt",
                    transform: "removeProtocolAndURI",
                },
                "host.email.tokens": {
                    friendlyName: "Hostname Tokens",
                    group: "email",
                    help: "Email Hostname Tokens",
                    dbField2: "email.hostTokens",
                    type: "lotextfield",
                    aliases: ["email.host.tokens"],
                    requiredRight: "emailSearch",
                    dbField: "email.hostTokens",
                    exp: "host.email.tokens",
                    transform: "removeProtocolAndURI",
                },
                "email.host.tokens": {
                    friendlyName: "Hostname Tokens",
                    group: "email",
                    help: "Email Hostname Tokens",
                    dbField2: "email.hostTokens",
                    type: "lotextfield",
                    aliases: ["email.host.tokens"],
                    requiredRight: "emailSearch",
                    dbField: "email.hostTokens",
                    exp: "host.email.tokens",
                    transform: "removeProtocolAndURI",
                },
                "email.x-mailer": {
                    friendlyName: "X-Mailer Header",
                    group: "email",
                    help: "Email X-Mailer header",
                    dbField2: "email.useragent",
                    type: "termfield",
                    requiredRight: "emailSearch",
                    dbField: "email.useragent",
                    exp: "email.x-mailer",
                },
                "email.x-mailer.cnt": {
                    friendlyName: "X-Mailer Header Cnt",
                    group: "email",
                    help: "Unique number of Email X-Mailer header",
                    dbField2: "email.useragentCnt",
                    type: "integer",
                    dbField: "email.useragentCnt",
                    exp: "email.x-mailer.cnt",
                },
                "email.src": {
                    friendlyName: "Sender",
                    group: "email",
                    help: "Email from address",
                    dbField2: "email.src",
                    type: "lotermfield",
                    requiredRight: "emailSearch",
                    category: "user",
                    dbField: "email.src",
                    exp: "email.src",
                },
                "email.src.cnt": {
                    friendlyName: "Sender Cnt",
                    group: "email",
                    help: "Unique number of Email from address",
                    dbField2: "email.srcCnt",
                    type: "integer",
                    dbField: "email.srcCnt",
                    exp: "email.src.cnt",
                },
                "email.dst": {
                    friendlyName: "Receiver",
                    group: "email",
                    help: "Email to address",
                    dbField2: "email.dst",
                    type: "lotermfield",
                    requiredRight: "emailSearch",
                    category: "user",
                    dbField: "email.dst",
                    exp: "email.dst",
                },
                "email.dst.cnt": {
                    friendlyName: "Receiver Cnt",
                    group: "email",
                    help: "Unique number of Email to address",
                    dbField2: "email.dstCnt",
                    type: "integer",
                    dbField: "email.dstCnt",
                    exp: "email.dst.cnt",
                },
                "email.subject": {
                    friendlyName: "Subject",
                    group: "email",
                    help: "Email subject header",
                    dbField2: "email.subject",
                    type: "termfield",
                    requiredRight: "emailSearch",
                    dbField: "email.subject",
                    exp: "email.subject",
                },
                "email.subject.cnt": {
                    friendlyName: "Subject Cnt",
                    group: "email",
                    help: "Unique number of Email subject header",
                    dbField2: "email.subjectCnt",
                    type: "integer",
                    dbField: "email.subjectCnt",
                    exp: "email.subject.cnt",
                },
                "email.message-id": {
                    friendlyName: "Id",
                    group: "email",
                    help: "Email Message-Id header",
                    dbField2: "email.id",
                    type: "termfield",
                    requiredRight: "emailSearch",
                    dbField: "email.id",
                    exp: "email.message-id",
                },
                "email.message-id.cnt": {
                    friendlyName: "Id Cnt",
                    group: "email",
                    help: "Unique number of Email Message-Id header",
                    dbField2: "email.idCnt",
                    type: "integer",
                    dbField: "email.idCnt",
                    exp: "email.message-id.cnt",
                },
                "email.content-type": {
                    friendlyName: "Content-Type",
                    group: "email",
                    help: "Email content-type header",
                    dbField2: "email.contentType",
                    type: "termfield",
                    dbField: "email.contentType",
                    exp: "email.content-type",
                },
                "email.content-type.cnt": {
                    friendlyName: "Content-Type Cnt",
                    group: "email",
                    help: "Unique number of Email content-type header",
                    dbField2: "email.contentTypeCnt",
                    type: "integer",
                    dbField: "email.contentTypeCnt",
                    exp: "email.content-type.cnt",
                },
                "email.mime-version": {
                    friendlyName: "Mime-Version",
                    group: "email",
                    help: "Email Mime-Header header",
                    dbField2: "email.mimeVersion",
                    type: "termfield",
                    dbField: "email.mimeVersion",
                    exp: "email.mime-version",
                },
                "email.mime-version.cnt": {
                    friendlyName: "Mime-Version Cnt",
                    group: "email",
                    help: "Unique number of Email Mime-Header header",
                    dbField2: "email.mimeVersionCnt",
                    type: "integer",
                    dbField: "email.mimeVersionCnt",
                    exp: "email.mime-version.cnt",
                },
                "email.fn": {
                    friendlyName: "Filenames",
                    group: "email",
                    help: "Email attachment filenames",
                    dbField2: "email.filename",
                    type: "termfield",
                    requiredRight: "emailSearch",
                    dbField: "email.filename",
                    exp: "email.fn",
                },
                "email.fn.cnt": {
                    friendlyName: "Filenames Cnt",
                    group: "email",
                    help: "Unique number of Email attachment filenames",
                    dbField2: "email.filenameCnt",
                    type: "integer",
                    dbField: "email.filenameCnt",
                    exp: "email.fn.cnt",
                },
                "email.md5": {
                    friendlyName: "Attach MD5s",
                    group: "email",
                    help: "Email attachment MD5s",
                    dbField2: "email.md5",
                    type: "termfield",
                    requiredRight: "emailSearch",
                    category: "md5",
                    dbField: "email.md5",
                    exp: "email.md5",
                },
                "email.md5.cnt": {
                    friendlyName: "Attach MD5s Cnt",
                    group: "email",
                    help: "Unique number of Email attachment MD5s",
                    dbField2: "email.md5Cnt",
                    type: "integer",
                    dbField: "email.md5Cnt",
                    exp: "email.md5.cnt",
                },
                "email.file-content-type": {
                    friendlyName: "Attach Content-Type",
                    group: "email",
                    help: "Email attachment content types",
                    dbField2: "email.fileContentType",
                    type: "termfield",
                    requiredRight: "emailSearch",
                    dbField: "email.fileContentType",
                    exp: "email.file-content-type",
                },
                "email.file-content-type.cnt": {
                    friendlyName: "Attach Content-Type Cnt",
                    group: "email",
                    help: "Unique number of Email attachment content types",
                    dbField2: "email.fileContentTypeCnt",
                    type: "integer",
                    dbField: "email.fileContentTypeCnt",
                    exp: "email.file-content-type.cnt",
                },
                "ip.email": {
                    friendlyName: "IP",
                    group: "email",
                    help: "Email IP address",
                    dbField2: "email.ip",
                    type: "ip",
                    requiredRight: "emailSearch",
                    category: "ip",
                    dbField: "email.ip",
                    exp: "ip.email",
                },
                "ip.email.cnt": {
                    friendlyName: "IP Cnt",
                    group: "email",
                    help: "Unique number of Email IP address",
                    dbField2: "email.ipCnt",
                    type: "integer",
                    dbField: "email.ipCnt",
                    exp: "ip.email.cnt",
                },
                "country.email": {
                    friendlyName: " GEO",
                    group: "email",
                    help: "GeoIP country string calculated from the Email IP address",
                    dbField2: "email.GEO",
                    type: "uptermfield",
                    dbField: "email.GEO",
                    exp: "country.email",
                },
                "asn.email": {
                    friendlyName: " ASN",
                    group: "email",
                    help: "GeoIP ASN string calculated from the Email IP address",
                    dbField2: "email.ASN",
                    type: "termfield",
                    dbField: "email.ASN",
                    exp: "asn.email",
                },
                "rir.email": {
                    friendlyName: " RIR",
                    group: "email",
                    help: "Regional Internet Registry string calculated from Email IP address",
                    dbField2: "email.RIR",
                    type: "uptermfield",
                    dbField: "email.RIR",
                    exp: "rir.email",
                },
                "email.has-header": {
                    friendlyName: "Header",
                    group: "email",
                    help: "Email has the header set",
                    dbField2: "email.header",
                    type: "lotermfield",
                    requiredRight: "emailSearch",
                    dbField: "email.header",
                    exp: "email.has-header",
                },
                "email.has-header.cnt": {
                    friendlyName: "Header Cnt",
                    group: "email",
                    help: "Unique number of Email has the header set",
                    dbField2: "email.headerCnt",
                    type: "integer",
                    dbField: "email.headerCnt",
                    exp: "email.has-header.cnt",
                },
                "email.has-header.value": {
                    friendlyName: "Header Value",
                    group: "email",
                    help: "Email has the header value",
                    dbField2: "email.headerValue",
                    type: "termfield",
                    requiredRight: "emailSearch",
                    dbField: "email.headerValue",
                    exp: "email.has-header.value",
                },
                "email.has-header.value.cnt": {
                    friendlyName: "Header Value Cnt",
                    group: "email",
                    help: "Unique number of Email has the header value",
                    dbField2: "email.headerValueCnt",
                    type: "integer",
                    dbField: "email.headerValueCnt",
                    exp: "email.has-header.value.cnt",
                },
                "email.bodymagic": {
                    friendlyName: "Body Magic",
                    group: "email",
                    help: "The content type of body determined by libfile/magic",
                    dbField2: "email.bodyMagic",
                    type: "termfield",
                    dbField: "email.bodyMagic",
                    exp: "email.bodymagic",
                },
                "email.bodymagic.cnt": {
                    friendlyName: "Body Magic Cnt",
                    group: "email",
                    help: "Unique number of The content type of body determined by libfile/magic",
                    dbField2: "email.bodyMagicCnt",
                    type: "integer",
                    dbField: "email.bodyMagicCnt",
                    exp: "email.bodymagic.cnt",
                },
                "email.smtp-hello": {
                    friendlyName: "SMTP Hello",
                    group: "email",
                    help: "SMTP HELO/EHLO",
                    dbField2: "email.smtpHello",
                    type: "lotermfield",
                    dbField: "email.smtpHello",
                    exp: "email.smtp-hello",
                },
                "email.smtp-hello.cnt": {
                    friendlyName: "SMTP Hello Cnt",
                    group: "email",
                    help: "Unique number of SMTP HELO/EHLO",
                    dbField2: "email.smtpHelloCnt",
                    type: "integer",
                    dbField: "email.smtpHelloCnt",
                    exp: "email.smtp-hello.cnt",
                },
                "email.x-priority": {
                    friendlyName: "email.x-priority",
                    group: "email",
                    help: "Email header x-priority",
                    dbField2: "email.header-x-priority",
                    type: "integer",
                    dbField: "email.header-x-priority",
                    exp: "email.x-priority",
                },
                "email.authorization": {
                    friendlyName: "email.authorization",
                    group: "email",
                    help: "Email header authorization",
                    dbField2: "email.header-authorization",
                    type: "termfield",
                    dbField: "email.header-authorization",
                    exp: "email.authorization",
                },
                "snmp.version": {
                    friendlyName: "Version",
                    group: "snmp",
                    help: "SNMP Version",
                    dbField2: "snmp.version",
                    type: "integer",
                    dbField: "snmp.version",
                    exp: "snmp.version",
                },
                "snmp.version.cnt": {
                    friendlyName: "Version Cnt",
                    group: "snmp",
                    help: "Unique number of SNMP Version",
                    dbField2: "snmp.versionCnt",
                    type: "integer",
                    dbField: "snmp.versionCnt",
                    exp: "snmp.version.cnt",
                },
                "snmp.community": {
                    friendlyName: "Community",
                    group: "snmp",
                    help: "SNMP Community",
                    dbField2: "snmp.community",
                    type: "termfield",
                    dbField: "snmp.community",
                    exp: "snmp.community",
                },
                "snmp.community.cnt": {
                    friendlyName: "Community Cnt",
                    group: "snmp",
                    help: "Unique number of SNMP Community",
                    dbField2: "snmp.communityCnt",
                    type: "integer",
                    dbField: "snmp.communityCnt",
                    exp: "snmp.community.cnt",
                },
                "snmp.error": {
                    friendlyName: "Error Code",
                    group: "snmp",
                    help: "SNMP Error Code",
                    dbField2: "snmp.error",
                    type: "integer",
                    dbField: "snmp.error",
                    exp: "snmp.error",
                },
                "snmp.error.cnt": {
                    friendlyName: "Error Code Cnt",
                    group: "snmp",
                    help: "Unique number of SNMP Error Code",
                    dbField2: "snmp.errorCnt",
                    type: "integer",
                    dbField: "snmp.errorCnt",
                    exp: "snmp.error.cnt",
                },
                "snmp.variable": {
                    friendlyName: "Variable",
                    group: "snmp",
                    help: "SNMP Variable",
                    dbField2: "snmp.variable",
                    type: "termfield",
                    dbField: "snmp.variable",
                    exp: "snmp.variable",
                },
                "snmp.variable.cnt": {
                    friendlyName: "Variable Cnt",
                    group: "snmp",
                    help: "Unique number of SNMP Variable",
                    dbField2: "snmp.variableCnt",
                    type: "integer",
                    dbField: "snmp.variableCnt",
                    exp: "snmp.variable.cnt",
                },
                "snmp.type": {
                    friendlyName: "Type",
                    group: "snmp",
                    help: "SNMP Type",
                    dbField2: "snmp.type",
                    type: "termfield",
                    dbField: "snmp.type",
                    exp: "snmp.type",
                },
                "snmp.type.cnt": {
                    friendlyName: "Type Cnt",
                    group: "snmp",
                    help: "Unique number of SNMP Type",
                    dbField2: "snmp.typeCnt",
                    type: "integer",
                    dbField: "snmp.typeCnt",
                    exp: "snmp.type.cnt",
                },
                "ip.socks": {
                    friendlyName: "IP",
                    group: "socks",
                    help: "SOCKS destination IP",
                    dbField2: "socks.ip",
                    type: "ip",
                    aliases: ["socks.ip"],
                    portField: "socks.port",
                    portField2: "socks.port",
                    dbField: "socks.ip",
                    exp: "ip.socks",
                },
                "socks.ip": {
                    friendlyName: "IP",
                    group: "socks",
                    help: "SOCKS destination IP",
                    dbField2: "socks.ip",
                    type: "ip",
                    aliases: ["socks.ip"],
                    portField: "socks.port",
                    portField2: "socks.port",
                    dbField: "socks.ip",
                    exp: "ip.socks",
                },
                "country.socks": {
                    friendlyName: " GEO",
                    group: "socks",
                    help: "GeoIP country string calculated from the SOCKS destination IP",
                    dbField2: "socks.GEO",
                    type: "uptermfield",
                    dbField: "socks.GEO",
                    exp: "country.socks",
                },
                "asn.socks": {
                    friendlyName: " ASN",
                    group: "socks",
                    help: "GeoIP ASN string calculated from the SOCKS destination IP",
                    dbField2: "socks.ASN",
                    type: "termfield",
                    dbField: "socks.ASN",
                    exp: "asn.socks",
                },
                "rir.socks": {
                    friendlyName: " RIR",
                    group: "socks",
                    help: "Regional Internet Registry string calculated from SOCKS destination IP",
                    dbField2: "socks.RIR",
                    type: "uptermfield",
                    dbField: "socks.RIR",
                    exp: "rir.socks",
                },
                "host.socks": {
                    friendlyName: "Host",
                    group: "socks",
                    help: "SOCKS destination host",
                    dbField2: "socks.host",
                    type: "lotermfield",
                    aliases: ["socks.host"],
                    category: "host",
                    dbField: "socks.host",
                    exp: "host.socks",
                    transform: "removeProtocolAndURI",
                },
                "socks.host": {
                    friendlyName: "Host",
                    group: "socks",
                    help: "SOCKS destination host",
                    dbField2: "socks.host",
                    type: "lotermfield",
                    aliases: ["socks.host"],
                    category: "host",
                    dbField: "socks.host",
                    exp: "host.socks",
                    transform: "removeProtocolAndURI",
                },
                "host.socks.tokens": {
                    friendlyName: "Hostname Tokens",
                    group: "socks",
                    help: "SOCKS Hostname Tokens",
                    dbField2: "socks.hostTokens",
                    type: "lotextfield",
                    aliases: ["socks.host.tokens"],
                    dbField: "socks.hostTokens",
                    exp: "host.socks.tokens",
                    transform: "removeProtocolAndURI",
                },
                "socks.host.tokens": {
                    friendlyName: "Hostname Tokens",
                    group: "socks",
                    help: "SOCKS Hostname Tokens",
                    dbField2: "socks.hostTokens",
                    type: "lotextfield",
                    aliases: ["socks.host.tokens"],
                    dbField: "socks.hostTokens",
                    exp: "host.socks.tokens",
                    transform: "removeProtocolAndURI",
                },
                "port.socks": {
                    friendlyName: "Port",
                    group: "socks",
                    help: "SOCKS destination port",
                    dbField2: "socks.port",
                    type: "integer",
                    aliases: ["socks.port"],
                    category: "port",
                    dbField: "socks.port",
                    exp: "port.socks",
                },
                "socks.port": {
                    friendlyName: "Port",
                    group: "socks",
                    help: "SOCKS destination port",
                    dbField2: "socks.port",
                    type: "integer",
                    aliases: ["socks.port"],
                    category: "port",
                    dbField: "socks.port",
                    exp: "port.socks",
                },
                "socks.user": {
                    friendlyName: "User",
                    group: "socks",
                    help: "SOCKS authenticated user",
                    dbField2: "socks.user",
                    type: "termfield",
                    aliases: ["socksuser"],
                    category: "user",
                    dbField: "socks.user",
                    exp: "socks.user",
                },
                socksuser: {
                    friendlyName: "User",
                    group: "socks",
                    help: "SOCKS authenticated user",
                    dbField2: "socks.user",
                    type: "termfield",
                    aliases: ["socksuser"],
                    category: "user",
                    dbField: "socks.user",
                    exp: "socks.user",
                },
                "ssh.ver": {
                    friendlyName: "Version",
                    group: "ssh",
                    help: "SSH Software Version",
                    dbField2: "ssh.version",
                    type: "lotermfield",
                    dbField: "ssh.version",
                    exp: "ssh.ver",
                },
                "ssh.ver.cnt": {
                    friendlyName: "Version Cnt",
                    group: "ssh",
                    help: "Unique number of SSH Software Version",
                    dbField2: "ssh.versionCnt",
                    type: "integer",
                    dbField: "ssh.versionCnt",
                    exp: "ssh.ver.cnt",
                },
                "ssh.key": {
                    friendlyName: "Key",
                    group: "ssh",
                    help: "SSH Key",
                    dbField2: "ssh.key",
                    type: "termfield",
                    dbField: "ssh.key",
                    exp: "ssh.key",
                },
                "ssh.key.cnt": {
                    friendlyName: "Key Cnt",
                    group: "ssh",
                    help: "Unique number of SSH Key",
                    dbField2: "ssh.keyCnt",
                    type: "integer",
                    dbField: "ssh.keyCnt",
                    exp: "ssh.key.cnt",
                },
                "ssh.hassh": {
                    friendlyName: "HASSH",
                    group: "ssh",
                    help: "SSH HASSH field",
                    dbField2: "ssh.hassh",
                    type: "lotermfield",
                    dbField: "ssh.hassh",
                    exp: "ssh.hassh",
                },
                "ssh.hassh.cnt": {
                    friendlyName: "HASSH Cnt",
                    group: "ssh",
                    help: "Unique number of SSH HASSH field",
                    dbField2: "ssh.hasshCnt",
                    type: "integer",
                    dbField: "ssh.hasshCnt",
                    exp: "ssh.hassh.cnt",
                },
                "ssh.hasshServer": {
                    friendlyName: "HASSH Server",
                    group: "ssh",
                    help: "SSH HASSH Server field",
                    dbField2: "ssh.hasshServer",
                    type: "lotermfield",
                    dbField: "ssh.hasshServer",
                    exp: "ssh.hasshServer",
                },
                "ssh.hasshServer.cnt": {
                    friendlyName: "HASSH Server Cnt",
                    group: "ssh",
                    help: "Unique number of SSH HASSH Server field",
                    dbField2: "ssh.hasshServerCnt",
                    type: "integer",
                    dbField: "ssh.hasshServerCnt",
                    exp: "ssh.hasshServer.cnt",
                },
                "cert.cnt": {
                    friendlyName: "Cert Cnt",
                    group: "cert",
                    help: "Count of certificates",
                    dbField2: "certCnt",
                    type: "integer",
                    dbField: "certCnt",
                    exp: "cert.cnt",
                },
                "cert.alt": {
                    friendlyName: "Alt Name",
                    group: "cert",
                    help: "Certificate alternative names",
                    dbField2: "cert.alt",
                    type: "lotermfield",
                    dbField: "cert.alt",
                    exp: "cert.alt",
                },
                "cert.alt.cnt": {
                    friendlyName: "Alt Name Cnt",
                    group: "cert",
                    help: "Unique number of Certificate alternative names",
                    dbField2: "cert.altCnt",
                    type: "integer",
                    dbField: "cert.altCnt",
                    exp: "cert.alt.cnt",
                },
                "cert.serial": {
                    friendlyName: "Serial Number",
                    group: "cert",
                    help: "Serial Number",
                    dbField2: "cert.serial",
                    type: "lotermfield",
                    dbField: "cert.serial",
                    exp: "cert.serial",
                },
                "cert.issuer.cn": {
                    friendlyName: "Issuer CN",
                    group: "cert",
                    help: "Issuer's common name",
                    dbField2: "cert.issuerCN",
                    type: "lotermfield",
                    dbField: "cert.issuerCN",
                    exp: "cert.issuer.cn",
                },
                "cert.subject.cn": {
                    friendlyName: "Subject CN",
                    group: "cert",
                    help: "Subject's common name",
                    dbField2: "cert.subjectCN",
                    type: "lotermfield",
                    dbField: "cert.subjectCN",
                    exp: "cert.subject.cn",
                },
                "cert.issuer.on": {
                    friendlyName: "Issuer ON",
                    group: "cert",
                    help: "Issuer's organization name",
                    dbField2: "cert.issuerON",
                    type: "termfield",
                    dbField: "cert.issuerON",
                    exp: "cert.issuer.on",
                },
                "cert.subject.on": {
                    friendlyName: "Subject ON",
                    group: "cert",
                    help: "Subject's organization name",
                    dbField2: "cert.subjectON",
                    type: "termfield",
                    dbField: "cert.subjectON",
                    exp: "cert.subject.on",
                },
                "cert.issuer.ou": {
                    friendlyName: "Issuer Org Unit",
                    group: "cert",
                    help: "Issuer's organizational unit",
                    dbField2: "cert.issuerOU",
                    type: "termfield",
                    dbField: "cert.issuerOU",
                    exp: "cert.issuer.ou",
                },
                "cert.subject.ou": {
                    friendlyName: "Subject Org Unit",
                    group: "cert",
                    help: "Subject's organizational unit",
                    dbField2: "cert.subjectOU",
                    type: "termfield",
                    dbField: "cert.subjectOU",
                    exp: "cert.subject.ou",
                },
                "cert.hash": {
                    friendlyName: "Hash",
                    group: "cert",
                    help: "SHA1 hash of entire certificate",
                    dbField2: "cert.hash",
                    type: "lotermfield",
                    dbField: "cert.hash",
                    exp: "cert.hash",
                },
                "cert.notbefore": {
                    friendlyName: "Not Before",
                    group: "cert",
                    help: "Certificate is not valid before this date",
                    dbField2: "cert.notBefore",
                    type: "date",
                    dbField: "cert.notBefore",
                    exp: "cert.notbefore",
                },
                "cert.notafter": {
                    friendlyName: "Not After",
                    group: "cert",
                    help: "Certificate is not valid after this date",
                    dbField2: "cert.notAfter",
                    type: "date",
                    dbField: "cert.notAfter",
                    exp: "cert.notafter",
                },
                "cert.validfor": {
                    friendlyName: "Days Valid For",
                    group: "cert",
                    help: "Certificate is valid for this many days total",
                    dbField2: "cert.validDays",
                    type: "integer",
                    dbField: "cert.validDays",
                    exp: "cert.validfor",
                },
                "cert.remainingDays": {
                    friendlyName: "Days remaining",
                    group: "cert",
                    help: "Certificate is still valid for this many days",
                    dbField2: "cert.remainingDays",
                    type: "integer",
                    dbField: "cert.remainingDays",
                    exp: "cert.remainingDays",
                },
                "cert.validforSeconds": {
                    friendlyName: "Seconds Valid For",
                    group: "cert",
                    help: "Certificate is valid for this many seconds total",
                    dbField2: "cert.validSeconds",
                    type: "integer",
                    dbField: "cert.validSeconds",
                    exp: "cert.validforSeconds",
                },
                "cert.remainingSeconds": {
                    friendlyName: "Seconds remaining",
                    group: "cert",
                    help: "Certificate is still valid for this many seconds",
                    dbField2: "cert.remainingSeconds",
                    type: "integer",
                    dbField: "cert.remainingSeconds",
                    exp: "cert.remainingSeconds",
                },
                "cert.curve": {
                    friendlyName: "Curve",
                    group: "cert",
                    help: "Curve Algorithm",
                    dbField2: "cert.curve",
                    type: "termfield",
                    dbField: "cert.curve",
                    exp: "cert.curve",
                },
                "cert.publicAlgorithm": {
                    friendlyName: "Public Algorithm",
                    group: "cert",
                    help: "Public Key Algorithm",
                    dbField2: "cert.publicAlgorithm",
                    type: "termfield",
                    dbField: "cert.publicAlgorithm",
                    exp: "cert.publicAlgorithm",
                },
                "tls.version": {
                    friendlyName: "Version",
                    group: "tls",
                    help: "SSL/TLS version field",
                    dbField2: "tls.version",
                    type: "termfield",
                    dbField: "tls.version",
                    exp: "tls.version",
                },
                "tls.version.cnt": {
                    friendlyName: "Version Cnt",
                    group: "tls",
                    help: "Unique number of SSL/TLS version field",
                    dbField2: "tls.versionCnt",
                    type: "integer",
                    dbField: "tls.versionCnt",
                    exp: "tls.version.cnt",
                },
                "tls.cipher": {
                    friendlyName: "Cipher",
                    group: "tls",
                    help: "SSL/TLS cipher field",
                    dbField2: "tls.cipher",
                    type: "uptermfield",
                    dbField: "tls.cipher",
                    exp: "tls.cipher",
                },
                "tls.cipher.cnt": {
                    friendlyName: "Cipher Cnt",
                    group: "tls",
                    help: "Unique number of SSL/TLS cipher field",
                    dbField2: "tls.cipherCnt",
                    type: "integer",
                    dbField: "tls.cipherCnt",
                    exp: "tls.cipher.cnt",
                },
                "tls.ja3": {
                    friendlyName: "JA3",
                    group: "tls",
                    help: "SSL/TLS JA3 field",
                    dbField2: "tls.ja3",
                    type: "lotermfield",
                    dbField: "tls.ja3",
                    exp: "tls.ja3",
                },
                "tls.ja3.cnt": {
                    friendlyName: "JA3 Cnt",
                    group: "tls",
                    help: "Unique number of SSL/TLS JA3 field",
                    dbField2: "tls.ja3Cnt",
                    type: "integer",
                    dbField: "tls.ja3Cnt",
                    exp: "tls.ja3.cnt",
                },
                "tls.ja4": {
                    friendlyName: "JA4",
                    group: "tls",
                    help: "SSL/TLS JA4 field",
                    dbField2: "tls.ja4",
                    type: "lotermfield",
                    dbField: "tls.ja4",
                    exp: "tls.ja4",
                },
                "tls.ja4.cnt": {
                    friendlyName: "JA4 Cnt",
                    group: "tls",
                    help: "Unique number of SSL/TLS JA4 field",
                    dbField2: "tls.ja4Cnt",
                    type: "integer",
                    dbField: "tls.ja4Cnt",
                    exp: "tls.ja4.cnt",
                },
                "tls.ja4_r": {
                    friendlyName: "JA4_r",
                    group: "tls",
                    help: "SSL/TLS JA4_r field",
                    dbField2: "tls.ja4_r",
                    type: "lotermfield",
                    dbField: "tls.ja4_r",
                    exp: "tls.ja4_r",
                },
                "tls.ja4_r.cnt": {
                    friendlyName: "JA4_r Cnt",
                    group: "tls",
                    help: "Unique number of SSL/TLS JA4_r field",
                    dbField2: "tls.ja4_rCnt",
                    type: "integer",
                    dbField: "tls.ja4_rCnt",
                    exp: "tls.ja4_r.cnt",
                },
                "tls.ja3s": {
                    friendlyName: "JA3S",
                    group: "tls",
                    help: "SSL/TLS JA3S field",
                    dbField2: "tls.ja3s",
                    type: "lotermfield",
                    dbField: "tls.ja3s",
                    exp: "tls.ja3s",
                },
                "tls.ja3s.cnt": {
                    friendlyName: "JA3S Cnt",
                    group: "tls",
                    help: "Unique number of SSL/TLS JA3S field",
                    dbField2: "tls.ja3sCnt",
                    type: "integer",
                    dbField: "tls.ja3sCnt",
                    exp: "tls.ja3s.cnt",
                },
                "tls.sessionid.dst": {
                    friendlyName: "Dst Session Id",
                    group: "tls",
                    help: "SSL/TLS Dst Session Id",
                    dbField2: "tls.dstSessionId",
                    type: "lotermfield",
                    dbField: "tls.dstSessionId",
                    exp: "tls.sessionid.dst",
                },
                "tls.sessionid.src": {
                    friendlyName: "Src Session Id",
                    group: "tls",
                    help: "SSL/TLS Src Session Id",
                    dbField2: "tls.srcSessionId",
                    type: "lotermfield",
                    dbField: "tls.srcSessionId",
                    exp: "tls.sessionid.src",
                },
                "tls.sessionid": {
                    friendlyName: "Src or Dst Session Id",
                    group: "general",
                    help: "Shorthand for tls.sessionid.src or tls.sessionid.dst",
                    dbField2: "tlsidall",
                    type: "lotermfield",
                    regex: "^tls\\.sessionid\\.(?:(?!\\.cnt$).)*$",
                    dbField: "tlsidall",
                    exp: "tls.sessionid",
                },
                tags: {
                    friendlyName: "Tags",
                    group: "general",
                    help: "Tags set for session",
                    dbField2: "tags",
                    type: "termfield",
                    dbField: "tags",
                    exp: "tags",
                },
                "tags.cnt": {
                    friendlyName: "Tags Cnt",
                    group: "general",
                    help: "Unique number of Tags set for session",
                    dbField2: "tagsCnt",
                    type: "integer",
                    dbField: "tagsCnt",
                    exp: "tags.cnt",
                },
                asset: {
                    friendlyName: "Asset",
                    group: "general",
                    help: "Asset name",
                    dbField2: "asset",
                    type: "lotermfield",
                    dbField: "asset",
                    exp: "asset",
                },
                "asset.cnt": {
                    friendlyName: "Asset Cnt",
                    group: "general",
                    help: "Unique number of Asset name",
                    dbField2: "assetCnt",
                    type: "integer",
                    dbField: "assetCnt",
                    exp: "asset.cnt",
                },
                protocols: {
                    friendlyName: "Protocols",
                    group: "general",
                    help: "Protocols set for session",
                    dbField2: "protocol",
                    type: "termfield",
                    dbField: "protocol",
                    exp: "protocols",
                },
                "protocols.cnt": {
                    friendlyName: "Protocols Cnt",
                    group: "general",
                    help: "Unique number of Protocols set for session",
                    dbField2: "protocolCnt",
                    type: "integer",
                    dbField: "protocolCnt",
                    exp: "protocols.cnt",
                },
                "packets.src": {
                    friendlyName: "Src Packets",
                    group: "general",
                    help: "Total number of packets sent by source in a session",
                    dbField2: "srcPackets",
                    type: "integer",
                    fieldECS: "source.packets",
                    dbField: "source.packets",
                    exp: "packets.src",
                },
                "source.packets": {
                    friendlyName: "Src Packets",
                    group: "general",
                    help: "Total number of packets sent by source in a session",
                    dbField2: "srcPackets",
                    type: "integer",
                    fieldECS: "source.packets",
                    dbField: "source.packets",
                    exp: "packets.src",
                },
                "packets.dst": {
                    friendlyName: "Dst Packets",
                    group: "general",
                    help: "Total number of packets sent by destination in a session",
                    dbField2: "dstPackets",
                    type: "integer",
                    fieldECS: "destination.packets",
                    dbField: "destination.packets",
                    exp: "packets.dst",
                },
                "destination.packets": {
                    friendlyName: "Dst Packets",
                    group: "general",
                    help: "Total number of packets sent by destination in a session",
                    dbField2: "dstPackets",
                    type: "integer",
                    fieldECS: "destination.packets",
                    dbField: "destination.packets",
                    exp: "packets.dst",
                },
                communityId: {
                    friendlyName: "Community Id",
                    group: "general",
                    help: "Community id flow hash",
                    dbField2: "communityId",
                    type: "termfield",
                    fieldECS: "network.community_id",
                    dbField: "network.community_id",
                    exp: "communityId",
                },
                "network.community_id": {
                    friendlyName: "Community Id",
                    group: "general",
                    help: "Community id flow hash",
                    dbField2: "communityId",
                    type: "termfield",
                    fieldECS: "network.community_id",
                    dbField: "network.community_id",
                    exp: "communityId",
                },
            },
            dbFieldsMap: {
                ipall: {
                    friendlyName: "All IP fields",
                    group: "general",
                    help: "Search all ip fields",
                    type: "ip",
                    dbField2: "ipall",
                    noFacet: "true",
                    dbField: "ipall",
                    exp: "ip",
                },
                portall: {
                    friendlyName: "All port fields",
                    group: "general",
                    help: "Search all port fields",
                    type: "integer",
                    dbField2: "portall",
                    regex: "(^port\\.(?:(?!\\.cnt$).)*$|\\.port$)",
                    dbField: "portall",
                    exp: "port",
                },
                rirall: {
                    friendlyName: "All rir fields",
                    group: "general",
                    help: "Search all rir fields",
                    type: "uptermfield",
                    dbField2: "rirall",
                    regex: "(^rir\\.(?:(?!\\.cnt$).)*$|\\.rir$)",
                    dbField: "rirall",
                    exp: "rir",
                },
                geoall: {
                    friendlyName: "All country fields",
                    group: "general",
                    help: "Search all country fields",
                    type: "uptermfield",
                    dbField2: "geoall",
                    regex: "(^country\\.(?:(?!\\.cnt$).)*$|\\.country$)",
                    dbField: "geoall",
                    exp: "country",
                },
                asnall: {
                    friendlyName: "All ASN fields",
                    group: "general",
                    help: "Search all ASN fields",
                    type: "termfield",
                    dbField2: "asnall",
                    regex: "(^asn\\.(?:(?!\\.cnt$).)*$|\\.asn$)",
                    dbField: "asnall",
                    exp: "asn",
                },
                hostall: {
                    friendlyName: "All Host fields",
                    group: "general",
                    help: "Search all Host fields",
                    type: "lotermfield",
                    dbField2: "hostall",
                    regex: "(^host\\.(?:(?!\\.(cnt|tokens)$).)*$|\\.host$)",
                    dbField: "hostall",
                    exp: "host",
                    transform: "removeProtocolAndURI",
                },
                "source.as.number": {
                    friendlyName: "Src ASN Number",
                    group: "general",
                    help: "GeoIP ASN Number calculated from the source IP",
                    type: "integer",
                    fieldECS: "source.as.number",
                    dbField: "source.as.number",
                    exp: "source.as.number",
                },
                "source.as.organization.name": {
                    friendlyName: "Src ASN Name",
                    group: "general",
                    help: "GeoIP ASN Name calculated from the source IP",
                    type: "termfield",
                    fieldECS: "source.as.organization.name",
                    dbField: "source.as.organization.name",
                    exp: "source.as.organization.name",
                },
                srcRIR: {
                    friendlyName: "Src RIR",
                    group: "general",
                    help: "Source RIR",
                    type: "uptermfield",
                    dbField2: "srcRIR",
                    category: "rir",
                    dbField: "srcRIR",
                    exp: "rir.src",
                },
                "destination.as.number": {
                    friendlyName: "Dst ASN Number",
                    group: "general",
                    help: "GeoIP ASN Number calculated from the destination IP",
                    type: "integer",
                    fieldECS: "destination.as.number",
                    dbField: "destination.as.number",
                    exp: "destination.as.number",
                },
                "destination.as.organization.name": {
                    friendlyName: "Dst ASN Name",
                    group: "general",
                    help: "GeoIP ASN Name calculated from the destination IP",
                    type: "termfield",
                    fieldECS: "destination.as.organization.name",
                    dbField: "destination.as.organization.name",
                    exp: "destination.as.organization.name",
                },
                dstRIR: {
                    friendlyName: "Dst RIR",
                    group: "general",
                    help: "Destination RIR",
                    type: "uptermfield",
                    dbField2: "dstRIR",
                    category: "rir",
                    dbField: "dstRIR",
                    exp: "rir.dst",
                },
                totDataBytes: {
                    friendlyName: "Data bytes",
                    group: "general",
                    help: "Total number of data bytes sent AND received in a session",
                    type: "integer",
                    dbField2: "totDataBytes",
                    dbField: "totDataBytes",
                    exp: "databytes",
                },
                ipProtocol: {
                    friendlyName: "IP Protocol",
                    group: "general",
                    help: "IP protocol number or friendly name",
                    type: "lotermfield",
                    dbField2: "ipProtocol",
                    transform: "ipProtocolLookup",
                    dbField: "ipProtocol",
                    exp: "ip.protocol",
                },
                _id: {
                    friendlyName: "Arkime ID",
                    group: "general",
                    help: "Arkime ID for the session",
                    type: "termfield",
                    dbField2: "_id",
                    noFacet: "true",
                    dbField: "_id",
                    exp: "id",
                },
                rootId: {
                    friendlyName: "Arkime Root ID",
                    group: "general",
                    help: "Arkime ID of the first session in a multi session stream",
                    type: "termfield",
                    dbField2: "rootId",
                    dbField: "rootId",
                    exp: "rootId",
                },
                node: {
                    friendlyName: "Arkime Node",
                    group: "general",
                    help: "Arkime node name the session was recorded on",
                    type: "termfield",
                    dbField2: "node",
                    dbField: "node",
                    exp: "node",
                },
                srcNode: {
                    friendlyName: "Arkime Source Node",
                    group: "general",
                    help: "Source Arkime node name the session was recorded on when using send to cluster",
                    type: "termfield",
                    dbField2: "srcNode",
                    dbField: "srcNode",
                    exp: "srcNode",
                },
                fileand: {
                    friendlyName: "Filename",
                    group: "general",
                    help: "Arkime offline pcap filename",
                    type: "fileand",
                    dbField2: "fileand",
                    dbField: "fileand",
                    exp: "file",
                },
                srcPayload8: {
                    friendlyName: "Payload Src UTF8",
                    group: "general",
                    help: "First 8 bytes of source payload in utf8",
                    type: "termfield",
                    dbField2: "srcPayload8",
                    transform: "utf8ToHex",
                    noFacet: "true",
                    dbField: "srcPayload8",
                    exp: "payload8.src.utf8",
                },
                dstPayload8: {
                    friendlyName: "Payload Dst UTF8",
                    group: "general",
                    help: "First 8 bytes of destination payload in utf8",
                    type: "termfield",
                    dbField2: "dstPayload8",
                    transform: "utf8ToHex",
                    noFacet: "true",
                    dbField: "dstPayload8",
                    exp: "payload8.dst.utf8",
                },
                fballhex: {
                    friendlyName: "Payload Hex",
                    group: "general",
                    help: "First 8 bytes of payload in hex",
                    type: "lotermfield",
                    dbField2: "fballhex",
                    regex: "^payload8.(src|dst).hex$",
                    dbField: "fballhex",
                    exp: "payload8.hex",
                },
                fballutf8: {
                    friendlyName: "Payload UTF8",
                    group: "general",
                    help: "First 8 bytes of payload in hex",
                    type: "lotermfield",
                    dbField2: "fballutf8",
                    regex: "^payload8.(src|dst).utf8$",
                    dbField: "fballutf8",
                    exp: "payload8.utf8",
                },
                scrubby: {
                    friendlyName: "Scrubbed By",
                    group: "general",
                    help: "SPI data was scrubbed by",
                    type: "lotermfield",
                    dbField2: "scrubby",
                    dbField: "scrubby",
                    exp: "scrubbed.by",
                },
                viewand: {
                    friendlyName: "View Name",
                    group: "general",
                    help: "Arkime view name",
                    type: "viewand",
                    dbField2: "viewand",
                    noFacet: "true",
                    dbField: "viewand",
                    exp: "view",
                },
                firstPacket: {
                    friendlyName: "Start Time",
                    group: "general",
                    help: "Session Start Time",
                    type: "seconds",
                    type2: "date",
                    dbField2: "firstPacket",
                    dbField: "firstPacket",
                    exp: "starttime",
                },
                lastPacket: {
                    friendlyName: "Stop Time",
                    group: "general",
                    help: "Session Stop Time",
                    type: "seconds",
                    type2: "date",
                    dbField2: "lastPacket",
                    dbField: "lastPacket",
                    exp: "stoptime",
                },
                huntId: {
                    friendlyName: "Hunt ID",
                    group: "general",
                    help: "The ID of the packet search job that matched this session",
                    type: "termfield",
                    dbField2: "huntId",
                    dbField: "huntId",
                    exp: "huntId",
                },
                huntName: {
                    friendlyName: "Hunt Name",
                    group: "general",
                    help: "The name of the packet search job that matched this session",
                    type: "termfield",
                    dbField2: "huntName",
                    dbField: "huntName",
                    exp: "huntName",
                },
                "client.bytes": {
                    friendlyName: "Src data bytes",
                    group: "general",
                    help: "Total number of data bytes sent by source in a session",
                    type: "integer",
                    dbField2: "srcDataBytes",
                    fieldECS: "client.bytes",
                    dbField: "client.bytes",
                    exp: "databytes.src",
                },
                srcDataBytes: {
                    friendlyName: "Src data bytes",
                    group: "general",
                    help: "Total number of data bytes sent by source in a session",
                    type: "integer",
                    dbField2: "srcDataBytes",
                    fieldECS: "client.bytes",
                    dbField: "client.bytes",
                    exp: "databytes.src",
                },
                "destination.bytes": {
                    friendlyName: "Dst Bytes",
                    group: "general",
                    help: "Total number of raw bytes sent by destination in a session",
                    type: "integer",
                    dbField2: "dstBytes",
                    fieldECS: "destination.bytes",
                    dbField: "destination.bytes",
                    exp: "bytes.dst",
                },
                dstBytes: {
                    friendlyName: "Dst Bytes",
                    group: "general",
                    help: "Total number of raw bytes sent by destination in a session",
                    type: "integer",
                    dbField2: "dstBytes",
                    fieldECS: "destination.bytes",
                    dbField: "destination.bytes",
                    exp: "bytes.dst",
                },
                "destination.ip": {
                    friendlyName: "Dst IP",
                    group: "general",
                    help: "Destination IP",
                    type: "ip",
                    dbField2: "dstIp",
                    portField2: "dstPort",
                    portFieldECS: "destination.port",
                    category: "ip",
                    aliases: ["ip.dst:port"],
                    fieldECS: "destination.ip",
                    dbField: "destination.ip",
                    portField: "destination.port",
                    exp: "ip.dst",
                },
                dstIp: {
                    friendlyName: "Dst IP",
                    group: "general",
                    help: "Destination IP",
                    type: "ip",
                    dbField2: "dstIp",
                    portField2: "dstPort",
                    portFieldECS: "destination.port",
                    category: "ip",
                    aliases: ["ip.dst:port"],
                    fieldECS: "destination.ip",
                    dbField: "destination.ip",
                    portField: "destination.port",
                    exp: "ip.dst",
                },
                "source.ip": {
                    friendlyName: "Src IP",
                    group: "general",
                    help: "Source IP",
                    type: "ip",
                    dbField2: "srcIp",
                    portField: "source.port",
                    portField2: "srcPort",
                    portFieldECS: "source.port",
                    category: "ip",
                    fieldECS: "source.ip",
                    dbField: "source.ip",
                    exp: "ip.src",
                },
                srcIp: {
                    friendlyName: "Src IP",
                    group: "general",
                    help: "Source IP",
                    type: "ip",
                    dbField2: "srcIp",
                    portField: "source.port",
                    portField2: "srcPort",
                    portFieldECS: "source.port",
                    category: "ip",
                    fieldECS: "source.ip",
                    dbField: "source.ip",
                    exp: "ip.src",
                },
                "destination.port": {
                    friendlyName: "Dst Port",
                    group: "general",
                    help: "Source Port",
                    type: "integer",
                    dbField2: "dstPort",
                    category: "port",
                    fieldECS: "destination.port",
                    dbField: "destination.port",
                    exp: "port.dst",
                },
                dstPort: {
                    friendlyName: "Dst Port",
                    group: "general",
                    help: "Source Port",
                    type: "integer",
                    dbField2: "dstPort",
                    category: "port",
                    fieldECS: "destination.port",
                    dbField: "destination.port",
                    exp: "port.dst",
                },
                "source.as.full": {
                    friendlyName: "Src ASN",
                    group: "general",
                    help: "GeoIP ASN string calculated from the source IP",
                    type: "termfield",
                    dbField2: "srcASN",
                    category: "asn",
                    fieldECS: "source.as.full",
                    dbField: "source.as.full",
                    exp: "asn.src",
                },
                srcASN: {
                    friendlyName: "Src ASN",
                    group: "general",
                    help: "GeoIP ASN string calculated from the source IP",
                    type: "termfield",
                    dbField2: "srcASN",
                    category: "asn",
                    fieldECS: "source.as.full",
                    dbField: "source.as.full",
                    exp: "asn.src",
                },
                "source.port": {
                    friendlyName: "Src Port",
                    group: "general",
                    help: "Source Port",
                    type: "integer",
                    dbField2: "srcPort",
                    category: "port",
                    fieldECS: "source.port",
                    dbField: "source.port",
                    exp: "port.src",
                },
                srcPort: {
                    friendlyName: "Src Port",
                    group: "general",
                    help: "Source Port",
                    type: "integer",
                    dbField2: "srcPort",
                    category: "port",
                    fieldECS: "source.port",
                    dbField: "source.port",
                    exp: "port.src",
                },
                "server.bytes": {
                    friendlyName: "Dst data bytes",
                    group: "general",
                    help: "Total number of data bytes sent by destination in a session",
                    type: "integer",
                    dbField2: "dstDataBytes",
                    fieldECS: "server.bytes",
                    dbField: "server.bytes",
                    exp: "databytes.dst",
                },
                dstDataBytes: {
                    friendlyName: "Dst data bytes",
                    group: "general",
                    help: "Total number of data bytes sent by destination in a session",
                    type: "integer",
                    dbField2: "dstDataBytes",
                    fieldECS: "server.bytes",
                    dbField: "server.bytes",
                    exp: "databytes.dst",
                },
                "network.packets": {
                    friendlyName: "Packets",
                    group: "general",
                    help: "Total number of packets sent AND received in a session",
                    type: "integer",
                    dbField2: "totPackets",
                    fieldECS: "network.packets",
                    dbField: "network.packets",
                    exp: "packets",
                },
                totPackets: {
                    friendlyName: "Packets",
                    group: "general",
                    help: "Total number of packets sent AND received in a session",
                    type: "integer",
                    dbField2: "totPackets",
                    fieldECS: "network.packets",
                    dbField: "network.packets",
                    exp: "packets",
                },
                "destination.geo.country_iso_code": {
                    friendlyName: "Dst Country",
                    group: "general",
                    help: "Destination Country",
                    type: "uptermfield",
                    dbField2: "dstGEO",
                    category: "country",
                    fieldECS: "destination.geo.country_iso_code",
                    dbField: "destination.geo.country_iso_code",
                    exp: "country.dst",
                },
                dstGEO: {
                    friendlyName: "Dst Country",
                    group: "general",
                    help: "Destination Country",
                    type: "uptermfield",
                    dbField2: "dstGEO",
                    category: "country",
                    fieldECS: "destination.geo.country_iso_code",
                    dbField: "destination.geo.country_iso_code",
                    exp: "country.dst",
                },
                "source.bytes": {
                    friendlyName: "Src Bytes",
                    group: "general",
                    help: "Total number of raw bytes sent by source in a session",
                    type: "integer",
                    dbField2: "srcBytes",
                    fieldECS: "source.bytes",
                    dbField: "source.bytes",
                    exp: "bytes.src",
                },
                srcBytes: {
                    friendlyName: "Src Bytes",
                    group: "general",
                    help: "Total number of raw bytes sent by source in a session",
                    type: "integer",
                    dbField2: "srcBytes",
                    fieldECS: "source.bytes",
                    dbField: "source.bytes",
                    exp: "bytes.src",
                },
                "network.bytes": {
                    friendlyName: "Bytes",
                    group: "general",
                    help: "Total number of raw bytes sent AND received in a session",
                    type: "integer",
                    dbField2: "totBytes",
                    fieldECS: "network.bytes",
                    dbField: "network.bytes",
                    exp: "bytes",
                },
                totBytes: {
                    friendlyName: "Bytes",
                    group: "general",
                    help: "Total number of raw bytes sent AND received in a session",
                    type: "integer",
                    dbField2: "totBytes",
                    fieldECS: "network.bytes",
                    dbField: "network.bytes",
                    exp: "bytes",
                },
                "source.geo.country_iso_code": {
                    friendlyName: "Src Country",
                    group: "general",
                    help: "Source Country",
                    type: "uptermfield",
                    dbField2: "srcGEO",
                    category: "country",
                    fieldECS: "source.geo.country_iso_code",
                    dbField: "source.geo.country_iso_code",
                    exp: "country.src",
                },
                srcGEO: {
                    friendlyName: "Src Country",
                    group: "general",
                    help: "Source Country",
                    type: "uptermfield",
                    dbField2: "srcGEO",
                    category: "country",
                    fieldECS: "source.geo.country_iso_code",
                    dbField: "source.geo.country_iso_code",
                    exp: "country.src",
                },
                "destination.as.full": {
                    friendlyName: "Dst ASN",
                    group: "general",
                    help: "GeoIP ASN string calculated from the destination IP",
                    type: "termfield",
                    dbField2: "dstASN",
                    category: "asn",
                    fieldECS: "destination.as.full",
                    dbField: "destination.as.full",
                    exp: "asn.dst",
                },
                dstASN: {
                    friendlyName: "Dst ASN",
                    group: "general",
                    help: "GeoIP ASN string calculated from the destination IP",
                    type: "termfield",
                    dbField2: "dstASN",
                    category: "asn",
                    fieldECS: "destination.as.full",
                    dbField: "destination.as.full",
                    exp: "asn.dst",
                },
                "source.mac": {
                    friendlyName: "Src MAC",
                    group: "general",
                    help: "Source ethernet mac addresses set for session",
                    dbField2: "source.mac",
                    type: "lotermfield",
                    transform: "dash2Colon",
                    fieldECS: "source.mac",
                    dbField: "source.mac",
                    exp: "mac.src",
                },
                "source.mac-cnt": {
                    friendlyName: "Src MAC Cnt",
                    group: "general",
                    help: "Unique number of Source ethernet mac addresses set for session",
                    dbField2: "source.mac-cnt",
                    type: "integer",
                    dbField: "source.mac-cnt",
                    exp: "mac.src.cnt",
                },
                "destination.mac": {
                    friendlyName: "Dst MAC",
                    group: "general",
                    help: "Destination ethernet mac addresses set for session",
                    dbField2: "destination.mac",
                    type: "lotermfield",
                    transform: "dash2Colon",
                    fieldECS: "destination.mac",
                    dbField: "destination.mac",
                    exp: "mac.dst",
                },
                "destination.mac-cnt": {
                    friendlyName: "Dst MAC Cnt",
                    group: "general",
                    help: "Unique number of Destination ethernet mac addresses set for session",
                    dbField2: "destination.mac-cnt",
                    type: "integer",
                    dbField: "destination.mac-cnt",
                    exp: "mac.dst.cnt",
                },
                srcOuterMac: {
                    friendlyName: "Src Outer MAC",
                    group: "general",
                    help: "Source ethernet outer mac addresses set for session",
                    dbField2: "srcOuterMac",
                    type: "lotermfield",
                    transform: "dash2Colon",
                    dbField: "srcOuterMac",
                    exp: "outermac.src",
                },
                "srcOuterMac-cnt": {
                    friendlyName: "Src Outer MAC Cnt",
                    group: "general",
                    help: "Unique number of Source ethernet outer mac addresses set for session",
                    dbField2: "srcOuterMac-cnt",
                    type: "integer",
                    dbField: "srcOuterMac-cnt",
                    exp: "outermac.src.cnt",
                },
                dstOuterMac: {
                    friendlyName: "Dst Outer MAC",
                    group: "general",
                    help: "Destination ethernet outer mac addresses set for session",
                    dbField2: "dstOuterMac",
                    type: "lotermfield",
                    transform: "dash2Colon",
                    dbField: "dstOuterMac",
                    exp: "outermac.dst",
                },
                "dstOuterMac-cnt": {
                    friendlyName: "Dst Outer MAC Cnt",
                    group: "general",
                    help: "Unique number of Destination ethernet outer mac addresses set for session",
                    dbField2: "dstOuterMac-cnt",
                    type: "integer",
                    dbField: "dstOuterMac-cnt",
                    exp: "outermac.dst.cnt",
                },
                srcDscp: {
                    friendlyName: "Src DSCP",
                    group: "general",
                    help: "Source non zero differentiated services class selector set for session",
                    dbField2: "srcDscp",
                    type: "integer",
                    dbField: "srcDscp",
                    exp: "dscp.src",
                },
                srcDscpCnt: {
                    friendlyName: "Src DSCP Cnt",
                    group: "general",
                    help: "Unique number of Source non zero differentiated services class selector set for session",
                    dbField2: "srcDscpCnt",
                    type: "integer",
                    dbField: "srcDscpCnt",
                    exp: "dscp.src.cnt",
                },
                dstDscp: {
                    friendlyName: "Dst DSCP",
                    group: "general",
                    help: "Destination non zero differentiated services class selector set for session",
                    dbField2: "dstDscp",
                    type: "integer",
                    dbField: "dstDscp",
                    exp: "dscp.dst",
                },
                dstDscpCnt: {
                    friendlyName: "Dst DSCP Cnt",
                    group: "general",
                    help: "Unique number of Destination non zero differentiated services class selector set for session",
                    dbField2: "dstDscpCnt",
                    type: "integer",
                    dbField: "dstDscpCnt",
                    exp: "dscp.dst.cnt",
                },
                macall: {
                    friendlyName: "Src or Dst MAC",
                    group: "general",
                    help: "Shorthand for mac.src or mac.dst",
                    dbField2: "macall",
                    type: "lotermfield",
                    regex: "^mac\\.(?:(?!\\.cnt$).)*$",
                    transform: "dash2Colon",
                    dbField: "macall",
                    exp: "mac",
                },
                outermacall: {
                    friendlyName: "Src or Dst Outer MAC",
                    group: "general",
                    help: "Shorthand for outermac.src or outermac.dst",
                    dbField2: "outermacall",
                    type: "lotermfield",
                    regex: "^outermac\\.(?:(?!\\.cnt$).)*$",
                    transform: "dash2Colon",
                    dbField: "outermacall",
                    exp: "outermac",
                },
                srcOui: {
                    friendlyName: "Src OUI",
                    group: "general",
                    help: "Source ethernet oui for session",
                    dbField2: "srcOui",
                    type: "termfield",
                    dbField: "srcOui",
                    exp: "oui.src",
                },
                srcOuiCnt: {
                    friendlyName: "Src OUI Cnt",
                    group: "general",
                    help: "Unique number of Source ethernet oui for session",
                    dbField2: "srcOuiCnt",
                    type: "integer",
                    dbField: "srcOuiCnt",
                    exp: "oui.src.cnt",
                },
                dstOui: {
                    friendlyName: "Dst OUI",
                    group: "general",
                    help: "Destination ethernet oui for session",
                    dbField2: "dstOui",
                    type: "termfield",
                    dbField: "dstOui",
                    exp: "oui.dst",
                },
                dstOuiCnt: {
                    friendlyName: "Dst OUI Cnt",
                    group: "general",
                    help: "Unique number of Destination ethernet oui for session",
                    dbField2: "dstOuiCnt",
                    type: "integer",
                    dbField: "dstOuiCnt",
                    exp: "oui.dst.cnt",
                },
                srcOuterOui: {
                    friendlyName: "Src Outer OUI",
                    group: "general",
                    help: "Source ethernet outer oui for session",
                    dbField2: "srcOuterOui",
                    type: "termfield",
                    dbField: "srcOuterOui",
                    exp: "outeroui.src",
                },
                srcOuterOuiCnt: {
                    friendlyName: "Src Outer OUI Cnt",
                    group: "general",
                    help: "Unique number of Source ethernet outer oui for session",
                    dbField2: "srcOuterOuiCnt",
                    type: "integer",
                    dbField: "srcOuterOuiCnt",
                    exp: "outeroui.src.cnt",
                },
                dstOuterOui: {
                    friendlyName: "Dst Outer OUI",
                    group: "general",
                    help: "Destination ethernet outer oui for session",
                    dbField2: "dstOuterOui",
                    type: "termfield",
                    dbField: "dstOuterOui",
                    exp: "outeroui.dst",
                },
                dstOuterOuiCnt: {
                    friendlyName: "Dst Outer OUI Cnt",
                    group: "general",
                    help: "Unique number of Destination ethernet outer oui for session",
                    dbField2: "dstOuterOuiCnt",
                    type: "integer",
                    dbField: "dstOuterOuiCnt",
                    exp: "outeroui.dst.cnt",
                },
                "network.vlan.id": {
                    friendlyName: "VLan",
                    group: "general",
                    help: "vlan value",
                    dbField2: "network.vlan.id",
                    type: "integer",
                    dbField: "network.vlan.id",
                    exp: "vlan",
                },
                "network.vlan.id-cnt": {
                    friendlyName: "VLan Cnt",
                    group: "general",
                    help: "Unique number of vlan value",
                    dbField2: "network.vlan.id-cnt",
                    type: "integer",
                    dbField: "network.vlan.id-cnt",
                    exp: "vlan.cnt",
                },
                vni: {
                    friendlyName: "VNI",
                    group: "general",
                    help: "vni value",
                    dbField2: "vni",
                    type: "integer",
                    dbField: "vni",
                    exp: "vni",
                },
                vniCnt: {
                    friendlyName: "VNI Cnt",
                    group: "general",
                    help: "Unique number of vni value",
                    dbField2: "vniCnt",
                    type: "integer",
                    dbField: "vniCnt",
                    exp: "vni.cnt",
                },
                srcOuterIp: {
                    friendlyName: "Src Outer IP",
                    group: "general",
                    help: "Source ethernet outer ip for session",
                    dbField2: "srcOuterIp",
                    type: "ip",
                    dbField: "srcOuterIp",
                    exp: "outerip.src",
                },
                srcOuterIpCnt: {
                    friendlyName: "Src Outer IP Cnt",
                    group: "general",
                    help: "Unique number of Source ethernet outer ip for session",
                    dbField2: "srcOuterIpCnt",
                    type: "integer",
                    dbField: "srcOuterIpCnt",
                    exp: "outerip.src.cnt",
                },
                srcOuterGEO: {
                    friendlyName: "Src Outer IP GEO",
                    group: "general",
                    help: "GeoIP country string calculated from the Source ethernet outer ip for session",
                    dbField2: "srcOuterGEO",
                    type: "uptermfield",
                    dbField: "srcOuterGEO",
                    exp: "outerip.src.country",
                },
                srcOuterASN: {
                    friendlyName: "Src Outer IP ASN",
                    group: "general",
                    help: "GeoIP ASN string calculated from the Source ethernet outer ip for session",
                    dbField2: "srcOuterASN",
                    type: "termfield",
                    dbField: "srcOuterASN",
                    exp: "outerip.src.asn",
                },
                srcOuterRIR: {
                    friendlyName: "Src Outer IP RIR",
                    group: "general",
                    help: "Regional Internet Registry string calculated from Source ethernet outer ip for session",
                    dbField2: "srcOuterRIR",
                    type: "uptermfield",
                    dbField: "srcOuterRIR",
                    exp: "outerip.src.rir",
                },
                dstOuterIp: {
                    friendlyName: "Dst Outer IP",
                    group: "general",
                    help: "Destination outer ip for session",
                    dbField2: "dstOuterIp",
                    type: "ip",
                    dbField: "dstOuterIp",
                    exp: "outerip.dst",
                },
                dstOuterIpCnt: {
                    friendlyName: "Dst Outer IP Cnt",
                    group: "general",
                    help: "Unique number of Destination outer ip for session",
                    dbField2: "dstOuterIpCnt",
                    type: "integer",
                    dbField: "dstOuterIpCnt",
                    exp: "outerip.dst.cnt",
                },
                dstOuterGEO: {
                    friendlyName: "Dst Outer IP GEO",
                    group: "general",
                    help: "GeoIP country string calculated from the Destination outer ip for session",
                    dbField2: "dstOuterGEO",
                    type: "uptermfield",
                    dbField: "dstOuterGEO",
                    exp: "outerip.dst.country",
                },
                dstOuterASN: {
                    friendlyName: "Dst Outer IP ASN",
                    group: "general",
                    help: "GeoIP ASN string calculated from the Destination outer ip for session",
                    dbField2: "dstOuterASN",
                    type: "termfield",
                    dbField: "dstOuterASN",
                    exp: "outerip.dst.asn",
                },
                dstOuterRIR: {
                    friendlyName: "Dst Outer IP RIR",
                    group: "general",
                    help: "Regional Internet Registry string calculated from Destination outer ip for session",
                    dbField2: "dstOuterRIR",
                    type: "uptermfield",
                    dbField: "dstOuterRIR",
                    exp: "outerip.dst.rir",
                },
                outeripall: {
                    friendlyName: "Src or Dst Outer IP",
                    group: "general",
                    help: "Shorthand for outerip.src or outerip.dst",
                    dbField2: "outeripall",
                    type: "lotermfield",
                    regex: "^outerip\\.(?:(?!\\.cnt$).)*$",
                    dbField: "outeripall",
                    exp: "outerip",
                },
                "tcpflags.syn": {
                    friendlyName: "TCP Flag SYN",
                    group: "general",
                    help: "Count of packets with SYN and no ACK flag set",
                    dbField2: "tcpflags.syn",
                    type: "integer",
                    dbField: "tcpflags.syn",
                    exp: "tcpflags.syn",
                },
                "tcpflags.syn-ack": {
                    friendlyName: "TCP Flag SYN-ACK",
                    group: "general",
                    help: "Count of packets with SYN and ACK flag set",
                    dbField2: "tcpflags.syn-ack",
                    type: "integer",
                    dbField: "tcpflags.syn-ack",
                    exp: "tcpflags.syn-ack",
                },
                "tcpflags.ack": {
                    friendlyName: "TCP Flag ACK",
                    group: "general",
                    help: "Count of packets with only the ACK flag set",
                    dbField2: "tcpflags.ack",
                    type: "integer",
                    dbField: "tcpflags.ack",
                    exp: "tcpflags.ack",
                },
                "tcpflags.psh": {
                    friendlyName: "TCP Flag PSH",
                    group: "general",
                    help: "Count of packets with PSH flag set",
                    dbField2: "tcpflags.psh",
                    type: "integer",
                    dbField: "tcpflags.psh",
                    exp: "tcpflags.psh",
                },
                "tcpflags.fin": {
                    friendlyName: "TCP Flag FIN",
                    group: "general",
                    help: "Count of packets with FIN flag set",
                    dbField2: "tcpflags.fin",
                    type: "integer",
                    dbField: "tcpflags.fin",
                    exp: "tcpflags.fin",
                },
                "tcpflags.rst": {
                    friendlyName: "TCP Flag RST",
                    group: "general",
                    help: "Count of packets with RST flag set",
                    dbField2: "tcpflags.rst",
                    type: "integer",
                    dbField: "tcpflags.rst",
                    exp: "tcpflags.rst",
                },
                "tcpflags.urg": {
                    friendlyName: "TCP Flag URG",
                    group: "general",
                    help: "Count of packets with URG flag set",
                    dbField2: "tcpflags.urg",
                    type: "integer",
                    dbField: "tcpflags.urg",
                    exp: "tcpflags.urg",
                },
                initRTT: {
                    friendlyName: "Initial RTT",
                    group: "general",
                    help: "Initial round trip time, difference between SYN and ACK timestamp divided by 2 in ms",
                    dbField2: "initRTT",
                    type: "integer",
                    dbField: "initRTT",
                    exp: "initRTT",
                },
                segmentCnt: {
                    friendlyName: "Session Segments",
                    group: "general",
                    help: "Number of segments in session so far",
                    dbField2: "segmentCnt",
                    type: "integer",
                    dbField: "segmentCnt",
                    exp: "session.segments",
                },
                length: {
                    friendlyName: "Session Length",
                    group: "general",
                    help: "Session Length in milliseconds so far",
                    dbField2: "length",
                    type: "integer",
                    dbField: "length",
                    exp: "session.length",
                },
                user: {
                    friendlyName: "User",
                    group: "general",
                    help: "External user set for session",
                    dbField2: "user",
                    type: "lotermfield",
                    category: "user",
                    dbField: "user",
                    exp: "user",
                },
                userCnt: {
                    friendlyName: "User Cnt",
                    group: "general",
                    help: "Unique number of External user set for session",
                    dbField2: "userCnt",
                    type: "integer",
                    dbField: "userCnt",
                    exp: "user.cnt",
                },
                "bgp.type": {
                    friendlyName: "Type",
                    group: "bgp",
                    help: "BGP Type field",
                    dbField2: "bgp.type",
                    type: "uptermfield",
                    dbField: "bgp.type",
                    exp: "bgp.type",
                },
                "dhcp.type": {
                    friendlyName: "Type",
                    group: "dhcp",
                    help: "DHCP Type",
                    dbField2: "dhcp.type",
                    type: "uptermfield",
                    dbField: "dhcp.type",
                    exp: "dhcp.type",
                },
                "dhcp.typeCnt": {
                    friendlyName: "Type Cnt",
                    group: "dhcp",
                    help: "Unique number of DHCP Type",
                    dbField2: "dhcp.typeCnt",
                    type: "integer",
                    dbField: "dhcp.typeCnt",
                    exp: "dhcp.type.cnt",
                },
                "dhcp.host": {
                    friendlyName: "Host",
                    group: "dhcp",
                    help: "DHCP Host",
                    dbField2: "dhcp.host",
                    type: "lotermfield",
                    aliases: ["host.dhcp"],
                    category: "host",
                    dbField: "dhcp.host",
                    exp: "dhcp.host",
                },
                "dhcp.hostCnt": {
                    friendlyName: "Host Cnt",
                    group: "dhcp",
                    help: "Unique number of DHCP Host",
                    dbField2: "dhcp.hostCnt",
                    type: "integer",
                    dbField: "dhcp.hostCnt",
                    exp: "dhcp.host.cnt",
                },
                "dhcp.hostTokens": {
                    friendlyName: "Hostname Tokens",
                    group: "dhcp",
                    help: "DHCP Hostname Tokens",
                    dbField2: "dhcp.hostTokens",
                    type: "lotextfield",
                    aliases: ["host.dhcp.tokens"],
                    dbField: "dhcp.hostTokens",
                    exp: "dhcp.host.tokens",
                },
                "dhcp.mac": {
                    friendlyName: "Client MAC",
                    group: "dhcp",
                    help: "Client ethernet MAC ",
                    dbField2: "dhcp.mac",
                    type: "lotermfield",
                    dbField: "dhcp.mac",
                    exp: "dhcp.mac",
                },
                "dhcp.macCnt": {
                    friendlyName: "Client MAC Cnt",
                    group: "dhcp",
                    help: "Unique number of Client ethernet MAC ",
                    dbField2: "dhcp.macCnt",
                    type: "integer",
                    dbField: "dhcp.macCnt",
                    exp: "dhcp.mac.cnt",
                },
                "dhcp.oui": {
                    friendlyName: "Client OUI",
                    group: "dhcp",
                    help: "Client ethernet OUI ",
                    dbField2: "dhcp.oui",
                    type: "termfield",
                    dbField: "dhcp.oui",
                    exp: "dhcp.oui",
                },
                "dhcp.ouiCnt": {
                    friendlyName: "Client OUI Cnt",
                    group: "dhcp",
                    help: "Unique number of Client ethernet OUI ",
                    dbField2: "dhcp.ouiCnt",
                    type: "integer",
                    dbField: "dhcp.ouiCnt",
                    exp: "dhcp.oui.cnt",
                },
                "dhcp.id": {
                    friendlyName: "Transaction id",
                    group: "dhcp",
                    help: "DHCP Transaction Id",
                    dbField2: "dhcp.id",
                    type: "lotermfield",
                    dbField: "dhcp.id",
                    exp: "dhcp.id",
                },
                "dhcp.idCnt": {
                    friendlyName: "Transaction id Cnt",
                    group: "dhcp",
                    help: "Unique number of DHCP Transaction Id",
                    dbField2: "dhcp.idCnt",
                    type: "integer",
                    dbField: "dhcp.idCnt",
                    exp: "dhcp.id.cnt",
                },
                "dns.ip": {
                    friendlyName: "IP",
                    group: "dns",
                    help: "IP from DNS result",
                    dbField2: "dns.ip",
                    type: "ip",
                    aliases: ["dns.ip"],
                    category: "ip",
                    dbField: "dns.ip",
                    exp: "ip.dns",
                },
                "dns.ipCnt": {
                    friendlyName: "IP Cnt",
                    group: "dns",
                    help: "Unique number of IP from DNS result",
                    dbField2: "dns.ipCnt",
                    type: "integer",
                    dbField: "dns.ipCnt",
                    exp: "ip.dns.cnt",
                },
                "dns.GEO": {
                    friendlyName: " GEO",
                    group: "dns",
                    help: "GeoIP country string calculated from the IP from DNS result",
                    dbField2: "dns.GEO",
                    type: "uptermfield",
                    dbField: "dns.GEO",
                    exp: "country.dns",
                },
                "dns.ASN": {
                    friendlyName: " ASN",
                    group: "dns",
                    help: "GeoIP ASN string calculated from the IP from DNS result",
                    dbField2: "dns.ASN",
                    type: "termfield",
                    dbField: "dns.ASN",
                    exp: "asn.dns",
                },
                "dns.RIR": {
                    friendlyName: " RIR",
                    group: "dns",
                    help: "Regional Internet Registry string calculated from IP from DNS result",
                    dbField2: "dns.RIR",
                    type: "uptermfield",
                    dbField: "dns.RIR",
                    exp: "rir.dns",
                },
                "dns.nameserverIp": {
                    friendlyName: "IP",
                    group: "dns",
                    help: "IPs for nameservers",
                    dbField2: "dns.nameserverIp",
                    type: "ip",
                    category: "ip",
                    dbField: "dns.nameserverIp",
                    exp: "ip.dns.nameserver",
                },
                "dns.nameserverIpCnt": {
                    friendlyName: "IP Cnt",
                    group: "dns",
                    help: "Unique number of IPs for nameservers",
                    dbField2: "dns.nameserverIpCnt",
                    type: "integer",
                    dbField: "dns.nameserverIpCnt",
                    exp: "ip.dns.nameserver.cnt",
                },
                "dns.nameserverGEO": {
                    friendlyName: " GEO",
                    group: "dns",
                    help: "GeoIP country string calculated from the IPs for nameservers",
                    dbField2: "dns.nameserverGEO",
                    type: "uptermfield",
                    dbField: "dns.nameserverGEO",
                    exp: "country.dns.nameserver",
                },
                "dns.nameserverASN": {
                    friendlyName: " ASN",
                    group: "dns",
                    help: "GeoIP ASN string calculated from the IPs for nameservers",
                    dbField2: "dns.nameserverASN",
                    type: "termfield",
                    dbField: "dns.nameserverASN",
                    exp: "asn.dns.nameserver",
                },
                "dns.nameserverRIR": {
                    friendlyName: " RIR",
                    group: "dns",
                    help: "Regional Internet Registry string calculated from IPs for nameservers",
                    dbField2: "dns.nameserverRIR",
                    type: "uptermfield",
                    dbField: "dns.nameserverRIR",
                    exp: "rir.dns.nameserver",
                },
                "dns.mailserverIp": {
                    friendlyName: "IP",
                    group: "dns",
                    help: "IPs for mailservers",
                    dbField2: "dns.mailserverIp",
                    type: "ip",
                    category: "ip",
                    dbField: "dns.mailserverIp",
                    exp: "ip.dns.mailserver",
                },
                "dns.mailserverIpCnt": {
                    friendlyName: "IP Cnt",
                    group: "dns",
                    help: "Unique number of IPs for mailservers",
                    dbField2: "dns.mailserverIpCnt",
                    type: "integer",
                    dbField: "dns.mailserverIpCnt",
                    exp: "ip.dns.mailserver.cnt",
                },
                "dns.mailserverGEO": {
                    friendlyName: " GEO",
                    group: "dns",
                    help: "GeoIP country string calculated from the IPs for mailservers",
                    dbField2: "dns.mailserverGEO",
                    type: "uptermfield",
                    dbField: "dns.mailserverGEO",
                    exp: "country.dns.mailserver",
                },
                "dns.mailserverASN": {
                    friendlyName: " ASN",
                    group: "dns",
                    help: "GeoIP ASN string calculated from the IPs for mailservers",
                    dbField2: "dns.mailserverASN",
                    type: "termfield",
                    dbField: "dns.mailserverASN",
                    exp: "asn.dns.mailserver",
                },
                "dns.mailserverRIR": {
                    friendlyName: " RIR",
                    group: "dns",
                    help: "Regional Internet Registry string calculated from IPs for mailservers",
                    dbField2: "dns.mailserverRIR",
                    type: "uptermfield",
                    dbField: "dns.mailserverRIR",
                    exp: "rir.dns.mailserver",
                },
                dnsipall: {
                    friendlyName: "IP",
                    group: "dns",
                    help: "Shorthand for ip.dns or ip.dns.nameserver",
                    dbField2: "dnsipall",
                    type: "ip",
                    regex: "^ip\\.dns(?:(?!\\.(cnt|all)$).)*$",
                    dbField: "dnsipall",
                    exp: "ip.dns.all",
                },
                "dns.host": {
                    friendlyName: "Host",
                    group: "dns",
                    help: "DNS lookup hostname",
                    dbField2: "dns.host",
                    type: "lotermfield",
                    aliases: ["dns.host"],
                    category: "host",
                    dbField: "dns.host",
                    exp: "host.dns",
                    transform: "removeProtocolAndURI",
                },
                "dns.hostCnt": {
                    friendlyName: "Host Cnt",
                    group: "dns",
                    help: "Unique number of DNS lookup hostname",
                    dbField2: "dns.hostCnt",
                    type: "integer",
                    dbField: "dns.hostCnt",
                    exp: "host.dns.cnt",
                    transform: "removeProtocolAndURI",
                },
                "dns.hostTokens": {
                    friendlyName: "Hostname Tokens",
                    group: "dns",
                    help: "DNS lookup hostname tokens",
                    dbField2: "dns.hostTokens",
                    type: "lotextfield",
                    aliases: ["dns.host.tokens"],
                    dbField: "dns.hostTokens",
                    exp: "host.dns.tokens",
                    transform: "removeProtocolAndURI",
                },
                "dns.nameserverHost": {
                    friendlyName: "NS Host",
                    group: "dns",
                    help: "Hostnames for Name Server",
                    dbField2: "dns.nameserverHost",
                    type: "lotermfield",
                    category: "host",
                    dbField: "dns.nameserverHost",
                    exp: "host.dns.nameserver",
                    transform: "removeProtocolAndURI",
                },
                "dns.nameserverHostCnt": {
                    friendlyName: "NS Host Cnt",
                    group: "dns",
                    help: "Unique number of Hostnames for Name Server",
                    dbField2: "dns.nameserverHostCnt",
                    type: "integer",
                    dbField: "dns.nameserverHostCnt",
                    exp: "host.dns.nameserver.cnt",
                    transform: "removeProtocolAndURI",
                },
                "dns.mailserverHost": {
                    friendlyName: "MX Host",
                    group: "dns",
                    help: "Hostnames for Mail Exchange Server",
                    dbField2: "dns.mailserverHost",
                    type: "lotermfield",
                    category: "host",
                    dbField: "dns.mailserverHost",
                    exp: "host.dns.mailserver",
                    transform: "removeProtocolAndURI",
                },
                "dns.mailserverHostCnt": {
                    friendlyName: "MX Host Cnt",
                    group: "dns",
                    help: "Unique number of Hostnames for Mail Exchange Server",
                    dbField2: "dns.mailserverHostCnt",
                    type: "integer",
                    dbField: "dns.mailserverHostCnt",
                    exp: "host.dns.mailserver.cnt",
                    transform: "removeProtocolAndURI",
                },
                dnshostall: {
                    friendlyName: "All Host",
                    group: "dns",
                    help: "Shorthand for host.dns or host.dns.nameserver",
                    dbField2: "dnshostall",
                    type: "lotermfield",
                    regex: "^host\\.dns(?:(?!\\.(cnt|all)$).)*$",
                    dbField: "dnshostall",
                    exp: "host.dns.all",
                    transform: "removeProtocolAndURI",
                },
                "dns.puny": {
                    friendlyName: "Puny",
                    group: "dns",
                    help: "DNS lookup punycode",
                    dbField2: "dns.puny",
                    type: "lotermfield",
                    dbField: "dns.puny",
                    exp: "dns.puny",
                },
                "dns.punyCnt": {
                    friendlyName: "Puny Cnt",
                    group: "dns",
                    help: "Unique number of DNS lookup punycode",
                    dbField2: "dns.punyCnt",
                    type: "integer",
                    dbField: "dns.punyCnt",
                    exp: "dns.puny.cnt",
                },
                "dns.status": {
                    friendlyName: "Status Code",
                    group: "dns",
                    help: "DNS lookup return code",
                    dbField2: "dns.status",
                    type: "uptermfield",
                    dbField: "dns.status",
                    exp: "dns.status",
                },
                "dns.statusCnt": {
                    friendlyName: "Status Code Cnt",
                    group: "dns",
                    help: "Unique number of DNS lookup return code",
                    dbField2: "dns.statusCnt",
                    type: "integer",
                    dbField: "dns.statusCnt",
                    exp: "dns.status.cnt",
                },
                "dns.opcode": {
                    friendlyName: "Op Code",
                    group: "dns",
                    help: "DNS lookup op code",
                    dbField2: "dns.opcode",
                    type: "uptermfield",
                    dbField: "dns.opcode",
                    exp: "dns.opcode",
                },
                "dns.opcodeCnt": {
                    friendlyName: "Op Code Cnt",
                    group: "dns",
                    help: "Unique number of DNS lookup op code",
                    dbField2: "dns.opcodeCnt",
                    type: "integer",
                    dbField: "dns.opcodeCnt",
                    exp: "dns.opcode.cnt",
                },
                "dns.qt": {
                    friendlyName: "Query Type",
                    group: "dns",
                    help: "DNS lookup query type",
                    dbField2: "dns.qt",
                    type: "uptermfield",
                    dbField: "dns.qt",
                    exp: "dns.query.type",
                },
                "dns.qtCnt": {
                    friendlyName: "Query Type Cnt",
                    group: "dns",
                    help: "Unique number of DNS lookup query type",
                    dbField2: "dns.qtCnt",
                    type: "integer",
                    dbField: "dns.qtCnt",
                    exp: "dns.query.type.cnt",
                },
                "dns.qc": {
                    friendlyName: "Query Class",
                    group: "dns",
                    help: "DNS lookup query class",
                    dbField2: "dns.qc",
                    type: "uptermfield",
                    dbField: "dns.qc",
                    exp: "dns.query.class",
                },
                "dns.qcCnt": {
                    friendlyName: "Query Class Cnt",
                    group: "dns",
                    help: "Unique number of DNS lookup query class",
                    dbField2: "dns.qcCnt",
                    type: "integer",
                    dbField: "dns.qcCnt",
                    exp: "dns.query.class.cnt",
                },
                "dns.https.alpn": {
                    friendlyName: "Alpn",
                    group: "dns",
                    help: "DNS https alpn",
                    dbField2: "dns.https.alpn",
                    type: "lotermfield",
                    dbField: "dns.https.alpn",
                    exp: "dns.https.alpn",
                },
                "dns.https.alpnCnt": {
                    friendlyName: "Alpn Cnt",
                    group: "dns",
                    help: "Unique number of DNS https alpn",
                    dbField2: "dns.https.alpnCnt",
                    type: "integer",
                    dbField: "dns.https.alpnCnt",
                    exp: "dns.https.alpn.cnt",
                },
                "dns.https.ip": {
                    friendlyName: "IP",
                    group: "dns",
                    help: "DNS https ip",
                    dbField2: "dns.https.ip",
                    type: "ip",
                    aliases: ["dns.https.ip"],
                    category: "ip",
                    dbField: "dns.https.ip",
                    exp: "ip.dns.https",
                },
                "dns.https.ipCnt": {
                    friendlyName: "IP Cnt",
                    group: "dns",
                    help: "Unique number of DNS https ip",
                    dbField2: "dns.https.ipCnt",
                    type: "integer",
                    dbField: "dns.https.ipCnt",
                    exp: "ip.dns.https.cnt",
                },
                "dns.https.GEO": {
                    friendlyName: " GEO",
                    group: "dns",
                    help: "GeoIP country string calculated from the DNS https ip",
                    dbField2: "dns.https.GEO",
                    type: "uptermfield",
                    dbField: "dns.https.GEO",
                    exp: "country.dns.https",
                },
                "dns.https.ASN": {
                    friendlyName: " ASN",
                    group: "dns",
                    help: "GeoIP ASN string calculated from the DNS https ip",
                    dbField2: "dns.https.ASN",
                    type: "termfield",
                    dbField: "dns.https.ASN",
                    exp: "asn.dns.https",
                },
                "dns.https.RIR": {
                    friendlyName: " RIR",
                    group: "dns",
                    help: "Regional Internet Registry string calculated from DNS https ip",
                    dbField2: "dns.https.RIR",
                    type: "uptermfield",
                    dbField: "dns.https.RIR",
                    exp: "rir.dns.https",
                },
                "dns.https.port": {
                    friendlyName: "IP",
                    group: "dns",
                    help: "DNS https port",
                    dbField2: "dns.https.port",
                    type: "integer",
                    dbField: "dns.https.port",
                    exp: "dns.https.port",
                },
                "dns.https.portCnt": {
                    friendlyName: "IP Cnt",
                    group: "dns",
                    help: "Unique number of DNS https port",
                    dbField2: "dns.https.portCnt",
                    type: "integer",
                    dbField: "dns.https.portCnt",
                    exp: "dns.https.port.cnt",
                },
                "http.host": {
                    friendlyName: "Hostname",
                    group: "http",
                    help: "HTTP host header field",
                    dbField2: "http.host",
                    type: "lotermfield",
                    aliases: ["http.host"],
                    category: "host",
                    dbField: "http.host",
                    exp: "host.http",
                    transform: "removeProtocolAndURI",
                },
                "http.hostTokens": {
                    friendlyName: "Hostname Tokens",
                    group: "http",
                    help: "HTTP host Tokens header field",
                    dbField2: "http.hostTokens",
                    type: "lotextfield",
                    aliases: ["http.host.tokens"],
                    dbField: "http.hostTokens",
                    exp: "host.http.tokens",
                    transform: "removeProtocolAndURI",
                },
                "http.uri": {
                    friendlyName: "URI",
                    group: "http",
                    help: "URIs for request",
                    dbField2: "http.uri",
                    type: "termfield",
                    category: ["url", "host"],
                    dbField: "http.uri",
                    exp: "http.uri",
                    transform: "removeProtocol",
                },
                "http.uriCnt": {
                    friendlyName: "URI Cnt",
                    group: "http",
                    help: "Unique number of URIs for request",
                    dbField2: "http.uriCnt",
                    type: "integer",
                    dbField: "http.uriCnt",
                    exp: "http.uri.cnt",
                },
                "http.uriTokens": {
                    friendlyName: "URI Tokens",
                    group: "http",
                    help: "URIs Tokens for request",
                    dbField2: "http.uriTokens",
                    type: "lotextfield",
                    dbField: "http.uriTokens",
                    exp: "http.uri.tokens",
                    transform: "removeProtocol",
                },
                "http.xffIp": {
                    friendlyName: "XFF IP",
                    group: "http",
                    help: "X-Forwarded-For Header",
                    dbField2: "http.xffIp",
                    type: "ip",
                    category: "ip",
                    dbField: "http.xffIp",
                    exp: "ip.xff",
                },
                "http.xffIpCnt": {
                    friendlyName: "XFF IP Cnt",
                    group: "http",
                    help: "Unique number of X-Forwarded-For Header",
                    dbField2: "http.xffIpCnt",
                    type: "integer",
                    dbField: "http.xffIpCnt",
                    exp: "ip.xff.cnt",
                },
                "http.xffGEO": {
                    friendlyName: "XFF  GEO",
                    group: "http",
                    help: "GeoIP country string calculated from the X-Forwarded-For Header",
                    dbField2: "http.xffGEO",
                    type: "uptermfield",
                    dbField: "http.xffGEO",
                    exp: "country.xff",
                },
                "http.xffASN": {
                    friendlyName: "XFF  ASN",
                    group: "http",
                    help: "GeoIP ASN string calculated from the X-Forwarded-For Header",
                    dbField2: "http.xffASN",
                    type: "termfield",
                    dbField: "http.xffASN",
                    exp: "asn.xff",
                },
                "http.xffRIR": {
                    friendlyName: "XFF  RIR",
                    group: "http",
                    help: "Regional Internet Registry string calculated from X-Forwarded-For Header",
                    dbField2: "http.xffRIR",
                    type: "uptermfield",
                    dbField: "http.xffRIR",
                    exp: "rir.xff",
                },
                "http.useragent": {
                    friendlyName: "Useragent",
                    group: "http",
                    help: "User-Agent Header",
                    dbField2: "http.useragent",
                    type: "termfield",
                    dbField: "http.useragent",
                    exp: "http.user-agent",
                },
                "http.useragentCnt": {
                    friendlyName: "Useragent Cnt",
                    group: "http",
                    help: "Unique number of User-Agent Header",
                    dbField2: "http.useragentCnt",
                    type: "integer",
                    dbField: "http.useragentCnt",
                    exp: "http.user-agent.cnt",
                },
                "http.useragentTokens": {
                    friendlyName: "Useragent Tokens",
                    group: "http",
                    help: "User-Agent Header Tokens",
                    dbField2: "http.useragentTokens",
                    type: "lotextfield",
                    dbField: "http.useragentTokens",
                    exp: "http.user-agent.tokens",
                },
                "http.requestHeader": {
                    friendlyName: "Has Src Header",
                    group: "http",
                    help: "Request has header present",
                    dbField2: "http.requestHeader",
                    type: "lotermfield",
                    dbField: "http.requestHeader",
                    exp: "http.hasheader.src",
                },
                "http.requestHeaderCnt": {
                    friendlyName: "Has Src Header Cnt",
                    group: "http",
                    help: "Unique number of Request has header present",
                    dbField2: "http.requestHeaderCnt",
                    type: "integer",
                    dbField: "http.requestHeaderCnt",
                    exp: "http.hasheader.src.cnt",
                },
                "http.responseHeader": {
                    friendlyName: "Has Dst Header",
                    group: "http",
                    help: "Response has header present",
                    dbField2: "http.responseHeader",
                    type: "lotermfield",
                    dbField: "http.responseHeader",
                    exp: "http.hasheader.dst",
                },
                "http.responseHeaderCnt": {
                    friendlyName: "Has Dst Header Cnt",
                    group: "http",
                    help: "Unique number of Response has header present",
                    dbField2: "http.responseHeaderCnt",
                    type: "integer",
                    dbField: "http.responseHeaderCnt",
                    exp: "http.hasheader.dst.cnt",
                },
                "http.requestHeaderValue": {
                    friendlyName: "Request Header Values",
                    group: "http",
                    help: "Contains request header values",
                    dbField2: "http.requestHeaderValue",
                    type: "lotermfield",
                    dbField: "http.requestHeaderValue",
                    exp: "http.hasheader.src.value",
                },
                "http.requestHeaderValueCnt": {
                    friendlyName: "Request Header Values Cnt",
                    group: "http",
                    help: "Unique number of Contains request header values",
                    dbField2: "http.requestHeaderValueCnt",
                    type: "integer",
                    dbField: "http.requestHeaderValueCnt",
                    exp: "http.hasheader.src.value.cnt",
                },
                "http.responseHeaderValue": {
                    friendlyName: "Response Header Values",
                    group: "http",
                    help: "Contains response header values",
                    dbField2: "http.responseHeaderValue",
                    type: "lotermfield",
                    dbField: "http.responseHeaderValue",
                    exp: "http.hasheader.dst.value",
                },
                "http.responseHeaderValueCnt": {
                    friendlyName: "Response Header Values Cnt",
                    group: "http",
                    help: "Unique number of Contains response header values",
                    dbField2: "http.responseHeaderValueCnt",
                    type: "integer",
                    dbField: "http.responseHeaderValueCnt",
                    exp: "http.hasheader.dst.value.cnt",
                },
                hhall: {
                    friendlyName: "Has Src or Dst Header",
                    group: "http",
                    help: "Shorthand for http.hasheader.src or http.hasheader.dst",
                    dbField2: "hhall",
                    type: "lotermfield",
                    regex: "^http\\.hasheader\\.(?:(?!(cnt|value)$).)*$",
                    dbField: "hhall",
                    exp: "http.hasheader",
                },
                hhvalueall: {
                    friendlyName: "Has Value in Src or Dst Header",
                    group: "http",
                    help: "Shorthand for http.hasheader.src.value or http.hasheader.dst.value",
                    dbField2: "hhvalueall",
                    type: "lotermfield",
                    regex: "^http\\.hasheader\\.(src|dst)\\.value$",
                    dbField: "hhvalueall",
                    exp: "http.hasheader.value",
                },
                "http.md5": {
                    friendlyName: "Body MD5",
                    group: "http",
                    help: "MD5 of http body response",
                    dbField2: "http.md5",
                    type: "lotermfield",
                    category: "md5",
                    dbField: "http.md5",
                    exp: "http.md5",
                },
                httpversion: {
                    friendlyName: "Version",
                    group: "http",
                    help: "HTTP version number",
                    dbField2: "httpversion",
                    type: "termfield",
                    regex: "^http.version.[a-z]+$",
                    dbField: "httpversion",
                    exp: "http.version",
                },
                "http.clientVersion": {
                    friendlyName: "Src Version",
                    group: "http",
                    help: "Request HTTP version number",
                    dbField2: "http.clientVersion",
                    type: "termfield",
                    dbField: "http.clientVersion",
                    exp: "http.version.src",
                },
                "http.clientVersionCnt": {
                    friendlyName: "Src Version Cnt",
                    group: "http",
                    help: "Unique number of Request HTTP version number",
                    dbField2: "http.clientVersionCnt",
                    type: "integer",
                    dbField: "http.clientVersionCnt",
                    exp: "http.version.src.cnt",
                },
                "http.serverVersion": {
                    friendlyName: "Dst Version",
                    group: "http",
                    help: "Response HTTP version number",
                    dbField2: "http.serverVersion",
                    type: "termfield",
                    dbField: "http.serverVersion",
                    exp: "http.version.dst",
                },
                "http.serverVersionCnt": {
                    friendlyName: "Dst Version Cnt",
                    group: "http",
                    help: "Unique number of Response HTTP version number",
                    dbField2: "http.serverVersionCnt",
                    type: "integer",
                    dbField: "http.serverVersionCnt",
                    exp: "http.version.dst.cnt",
                },
                "http.path": {
                    friendlyName: "URI Path",
                    group: "http",
                    help: "Path portion of URI",
                    dbField2: "http.path",
                    type: "termfield",
                    dbField: "http.path",
                    exp: "http.uri.path",
                },
                "http.pathCnt": {
                    friendlyName: "URI Path Cnt",
                    group: "http",
                    help: "Unique number of Path portion of URI",
                    dbField2: "http.pathCnt",
                    type: "integer",
                    dbField: "http.pathCnt",
                    exp: "http.uri.path.cnt",
                },
                "http.key": {
                    friendlyName: "QS Keys",
                    group: "http",
                    help: "Keys from query string of URI",
                    dbField2: "http.key",
                    type: "termfield",
                    dbField: "http.key",
                    exp: "http.uri.key",
                },
                "http.keyCnt": {
                    friendlyName: "QS Keys Cnt",
                    group: "http",
                    help: "Unique number of Keys from query string of URI",
                    dbField2: "http.keyCnt",
                    type: "integer",
                    dbField: "http.keyCnt",
                    exp: "http.uri.key.cnt",
                },
                "http.value": {
                    friendlyName: "QS Values",
                    group: "http",
                    help: "Values from query string of URI",
                    dbField2: "http.value",
                    type: "termfield",
                    dbField: "http.value",
                    exp: "http.uri.value",
                },
                "http.valueCnt": {
                    friendlyName: "QS Values Cnt",
                    group: "http",
                    help: "Unique number of Values from query string of URI",
                    dbField2: "http.valueCnt",
                    type: "integer",
                    dbField: "http.valueCnt",
                    exp: "http.uri.value.cnt",
                },
                "http.cookieKey": {
                    friendlyName: "Cookie Keys",
                    group: "http",
                    help: "The keys to cookies sent up in requests",
                    dbField2: "http.cookieKey",
                    type: "termfield",
                    dbField: "http.cookieKey",
                    exp: "http.cookie.key",
                },
                "http.cookieKeyCnt": {
                    friendlyName: "Cookie Keys Cnt",
                    group: "http",
                    help: "Unique number of The keys to cookies sent up in requests",
                    dbField2: "http.cookieKeyCnt",
                    type: "integer",
                    dbField: "http.cookieKeyCnt",
                    exp: "http.cookie.key.cnt",
                },
                "http.cookieValue": {
                    friendlyName: "Cookie Values",
                    group: "http",
                    help: "The values to cookies sent up in requests",
                    dbField2: "http.cookieValue",
                    type: "termfield",
                    dbField: "http.cookieValue",
                    exp: "http.cookie.value",
                },
                "http.cookieValueCnt": {
                    friendlyName: "Cookie Values Cnt",
                    group: "http",
                    help: "Unique number of The values to cookies sent up in requests",
                    dbField2: "http.cookieValueCnt",
                    type: "integer",
                    dbField: "http.cookieValueCnt",
                    exp: "http.cookie.value.cnt",
                },
                "http.method": {
                    friendlyName: "Request Method",
                    group: "http",
                    help: "HTTP Request Method",
                    dbField2: "http.method",
                    type: "termfield",
                    dbField: "http.method",
                    exp: "http.method",
                },
                "http.bodyMagic": {
                    friendlyName: "Body Magic",
                    group: "http",
                    help: "The content type of body determined by libfile/magic",
                    dbField2: "http.bodyMagic",
                    type: "termfield",
                    dbField: "http.bodyMagic",
                    exp: "http.bodymagic",
                },
                "http.user": {
                    friendlyName: "User",
                    group: "http",
                    help: "HTTP Auth User",
                    dbField2: "http.user",
                    type: "termfield",
                    category: "user",
                    dbField: "http.user",
                    exp: "http.user",
                },
                "http.userCnt": {
                    friendlyName: "User Cnt",
                    group: "http",
                    help: "Unique number of HTTP Auth User",
                    dbField2: "http.userCnt",
                    type: "integer",
                    dbField: "http.userCnt",
                    exp: "http.user.cnt",
                },
                "http.authType": {
                    friendlyName: "Auth Type",
                    group: "http",
                    help: "HTTP Auth Type",
                    dbField2: "http.authType",
                    type: "lotermfield",
                    dbField: "http.authType",
                    exp: "http.authtype",
                },
                "http.authTypeCnt": {
                    friendlyName: "Auth Type Cnt",
                    group: "http",
                    help: "Unique number of HTTP Auth Type",
                    dbField2: "http.authTypeCnt",
                    type: "integer",
                    dbField: "http.authTypeCnt",
                    exp: "http.authtype.cnt",
                },
                "http.statuscode": {
                    friendlyName: "Status Code",
                    group: "http",
                    help: "Response HTTP numeric status code",
                    dbField2: "http.statuscode",
                    type: "integer",
                    dbField: "http.statuscode",
                    exp: "http.statuscode",
                },
                "http.requestBody": {
                    friendlyName: "Request Body",
                    group: "http",
                    help: "HTTP Request Body",
                    dbField2: "http.requestBody",
                    type: "termfield",
                    dbField: "http.requestBody",
                    exp: "http.reqbody",
                },
                "http.method-DELETE": {
                    friendlyName: "Method DELETE Count",
                    group: "http",
                    help: "Number of DELETE method calls in session",
                    dbField2: "http.method-DELETE",
                    type: "integer",
                    dbField: "http.method-DELETE",
                    exp: "http.method.DELETE",
                },
                "http.method-GET": {
                    friendlyName: "Method GET Count",
                    group: "http",
                    help: "Number of GET method calls in session",
                    dbField2: "http.method-GET",
                    type: "integer",
                    dbField: "http.method-GET",
                    exp: "http.method.GET",
                },
                "http.method-HEAD": {
                    friendlyName: "Method HEAD Count",
                    group: "http",
                    help: "Number of HEAD method calls in session",
                    dbField2: "http.method-HEAD",
                    type: "integer",
                    dbField: "http.method-HEAD",
                    exp: "http.method.HEAD",
                },
                "http.method-POST": {
                    friendlyName: "Method POST Count",
                    group: "http",
                    help: "Number of POST method calls in session",
                    dbField2: "http.method-POST",
                    type: "integer",
                    dbField: "http.method-POST",
                    exp: "http.method.POST",
                },
                "http.method-PUT": {
                    friendlyName: "Method PUT Count",
                    group: "http",
                    help: "Number of PUT method calls in session",
                    dbField2: "http.method-PUT",
                    type: "integer",
                    dbField: "http.method-PUT",
                    exp: "http.method.PUT",
                },
                "http.method-CONNECT": {
                    friendlyName: "Method CONNECT Count",
                    group: "http",
                    help: "Number of CONNECT method calls in session",
                    dbField2: "http.method-CONNECT",
                    type: "integer",
                    dbField: "http.method-CONNECT",
                    exp: "http.method.CONNECT",
                },
                "http.method-OPTIONS": {
                    friendlyName: "Method OPTIONS Count",
                    group: "http",
                    help: "Number of OPTIONS method calls in session",
                    dbField2: "http.method-OPTIONS",
                    type: "integer",
                    dbField: "http.method-OPTIONS",
                    exp: "http.method.OPTIONS",
                },
                "http.request-referer": {
                    friendlyName: "http.request.referer",
                    group: "http",
                    help: "Request header referer",
                    dbField2: "http.request-referer",
                    type: "termfield",
                    aliases: ["http.referer"],
                    dbField: "http.request-referer",
                    exp: "http.request.referer",
                },
                "http.request-refererCnt": {
                    friendlyName: "http.request.referer Cnt",
                    group: "http",
                    help: "Unique number of Request header referer",
                    dbField2: "http.request-refererCnt",
                    type: "integer",
                    dbField: "http.request-refererCnt",
                    exp: "http.request.referer.cnt",
                },
                "http.request-authorization": {
                    friendlyName: "http.request.authorization",
                    group: "http",
                    help: "Request header authorization",
                    dbField2: "http.request-authorization",
                    type: "termfield",
                    aliases: ["http.authorization"],
                    dbField: "http.request-authorization",
                    exp: "http.request.authorization",
                },
                "http.request-authorizationCnt": {
                    friendlyName: "http.request.authorization Cnt",
                    group: "http",
                    help: "Unique number of Request header authorization",
                    dbField2: "http.request-authorizationCnt",
                    type: "integer",
                    dbField: "http.request-authorizationCnt",
                    exp: "http.request.authorization.cnt",
                },
                "http.request-content-type": {
                    friendlyName: "http.request.content-type",
                    group: "http",
                    help: "Request header content-type",
                    dbField2: "http.request-content-type",
                    type: "termfield",
                    aliases: ["http.content-type"],
                    dbField: "http.request-content-type",
                    exp: "http.request.content-type",
                },
                "http.request-content-typeCnt": {
                    friendlyName: "http.request.content-type Cnt",
                    group: "http",
                    help: "Unique number of Request header content-type",
                    dbField2: "http.request-content-typeCnt",
                    type: "integer",
                    dbField: "http.request-content-typeCnt",
                    exp: "http.request.content-type.cnt",
                },
                "http.request-origin": {
                    friendlyName: "http.request.origin",
                    group: "http",
                    help: "Request header origin",
                    dbField2: "http.request-origin",
                    type: "termfield",
                    aliases: ["http.origin"],
                    dbField: "http.request-origin",
                    exp: "http.request.origin",
                },
                "http.response-location": {
                    friendlyName: "http.response.location",
                    group: "http",
                    help: "Response header location",
                    dbField2: "http.response-location",
                    type: "termfield",
                    aliases: ["http.location"],
                    dbField: "http.response-location",
                    exp: "http.response.location",
                },
                "http.response-server": {
                    friendlyName: "http.response.server",
                    group: "http",
                    help: "Response header server",
                    dbField2: "http.response-server",
                    type: "termfield",
                    aliases: ["http.server"],
                    dbField: "http.response-server",
                    exp: "http.response.server",
                },
                "http.response-content-type": {
                    friendlyName: "http.response.content-type",
                    group: "http",
                    help: "Response header content-type",
                    dbField2: "http.response-content-type",
                    type: "termfield",
                    aliases: ["http.content-type"],
                    dbField: "http.response-content-type",
                    exp: "http.response.content-type",
                },
                "http.response-content-typeCnt": {
                    friendlyName: "http.response.content-type Cnt",
                    group: "http",
                    help: "Unique number of Response header content-type",
                    dbField2: "http.response-content-typeCnt",
                    type: "integer",
                    dbField: "http.response-content-typeCnt",
                    exp: "http.response.content-type.cnt",
                },
                "http.methodCnt": {
                    friendlyName: "Request Method Cnt",
                    group: "http",
                    help: "Unique number of HTTP Request Method",
                    dbField2: "http.methodCnt",
                    type: "integer",
                    dbField: "http.methodCnt",
                    exp: "http.method.cnt",
                },
                "http.statuscodeCnt": {
                    friendlyName: "Status Code Cnt",
                    group: "http",
                    help: "Unique number of Response HTTP numeric status code",
                    dbField2: "http.statuscodeCnt",
                    type: "integer",
                    dbField: "http.statuscodeCnt",
                    exp: "http.statuscode.cnt",
                },
                "http.hostCnt": {
                    friendlyName: "Hostname Cnt",
                    group: "http",
                    help: "Unique number of HTTP host header field",
                    dbField2: "http.hostCnt",
                    type: "integer",
                    dbField: "http.hostCnt",
                    exp: "host.http.cnt",
                    transform: "removeProtocolAndURI",
                },
                "http.bodyMagicCnt": {
                    friendlyName: "Body Magic Cnt",
                    group: "http",
                    help: "Unique number of The content type of body determined by libfile/magic",
                    dbField2: "http.bodyMagicCnt",
                    type: "integer",
                    dbField: "http.bodyMagicCnt",
                    exp: "http.bodymagic.cnt",
                },
                "http.md5Cnt": {
                    friendlyName: "Body MD5 Cnt",
                    group: "http",
                    help: "Unique number of MD5 of http body response",
                    dbField2: "http.md5Cnt",
                    type: "integer",
                    dbField: "http.md5Cnt",
                    exp: "http.md5.cnt",
                },
                "icmp.type": {
                    friendlyName: "ICMP Type",
                    group: "general",
                    help: "ICMP type field values",
                    dbField2: "icmp.type",
                    type: "integer",
                    dbField: "icmp.type",
                    exp: "icmp.type",
                },
                "icmp.code": {
                    friendlyName: "ICMP Code",
                    group: "general",
                    help: "ICMP code field values",
                    dbField2: "icmp.code",
                    type: "integer",
                    dbField: "icmp.code",
                    exp: "icmp.code",
                },
                "irc.nick": {
                    friendlyName: "Nickname",
                    group: "irc",
                    help: "Nicknames set",
                    dbField2: "irc.nick",
                    type: "termfield",
                    category: "user",
                    dbField: "irc.nick",
                    exp: "irc.nick",
                },
                "irc.nickCnt": {
                    friendlyName: "Nickname Cnt",
                    group: "irc",
                    help: "Unique number of Nicknames set",
                    dbField2: "irc.nickCnt",
                    type: "integer",
                    dbField: "irc.nickCnt",
                    exp: "irc.nick.cnt",
                },
                "irc.channel": {
                    friendlyName: "Channel",
                    group: "irc",
                    help: "Channels joined",
                    dbField2: "irc.channel",
                    type: "termfield",
                    dbField: "irc.channel",
                    exp: "irc.channel",
                },
                "irc.channelCnt": {
                    friendlyName: "Channel Cnt",
                    group: "irc",
                    help: "Unique number of Channels joined",
                    dbField2: "irc.channelCnt",
                    type: "integer",
                    dbField: "irc.channelCnt",
                    exp: "irc.channel.cnt",
                },
                "isis.msgType": {
                    friendlyName: "isis.msgType",
                    group: "isis",
                    help: "ISIS Msg Type field",
                    dbField2: "isis.msgType",
                    type: "lotermfield",
                    dbField: "isis.msgType",
                    exp: "isis.msgType",
                },
                "krb5.realm": {
                    friendlyName: "Realm",
                    group: "krb5",
                    help: "Kerberos 5 Realm",
                    dbField2: "krb5.realm",
                    type: "termfield",
                    dbField: "krb5.realm",
                    exp: "krb5.realm",
                },
                "krb5.realmCnt": {
                    friendlyName: "Realm Cnt",
                    group: "krb5",
                    help: "Unique number of Kerberos 5 Realm",
                    dbField2: "krb5.realmCnt",
                    type: "integer",
                    dbField: "krb5.realmCnt",
                    exp: "krb5.realm.cnt",
                },
                "krb5.cname": {
                    friendlyName: "cname",
                    group: "krb5",
                    help: "Kerberos 5 cname",
                    dbField2: "krb5.cname",
                    type: "termfield",
                    dbField: "krb5.cname",
                    exp: "krb5.cname",
                },
                "krb5.cnameCnt": {
                    friendlyName: "cname Cnt",
                    group: "krb5",
                    help: "Unique number of Kerberos 5 cname",
                    dbField2: "krb5.cnameCnt",
                    type: "integer",
                    dbField: "krb5.cnameCnt",
                    exp: "krb5.cname.cnt",
                },
                "krb5.sname": {
                    friendlyName: "sname",
                    group: "krb5",
                    help: "Kerberos 5 sname",
                    dbField2: "krb5.sname",
                    type: "termfield",
                    dbField: "krb5.sname",
                    exp: "krb5.sname",
                },
                "krb5.snameCnt": {
                    friendlyName: "sname Cnt",
                    group: "krb5",
                    help: "Unique number of Kerberos 5 sname",
                    dbField2: "krb5.snameCnt",
                    type: "integer",
                    dbField: "krb5.snameCnt",
                    exp: "krb5.sname.cnt",
                },
                "ldap.authtype": {
                    friendlyName: "Auth Type",
                    group: "ldap",
                    help: "The auth type of ldap bind",
                    dbField2: "ldap.authtype",
                    type: "termfield",
                    dbField: "ldap.authtype",
                    exp: "ldap.authtype",
                },
                "ldap.authtypeCnt": {
                    friendlyName: "Auth Type Cnt",
                    group: "ldap",
                    help: "Unique number of The auth type of ldap bind",
                    dbField2: "ldap.authtypeCnt",
                    type: "integer",
                    dbField: "ldap.authtypeCnt",
                    exp: "ldap.authtype.cnt",
                },
                "ldap.bindname": {
                    friendlyName: "Bind Name",
                    group: "ldap",
                    help: "The bind name of ldap bind",
                    dbField2: "ldap.bindname",
                    type: "termfield",
                    dbField: "ldap.bindname",
                    exp: "ldap.bindname",
                },
                "ldap.bindnameCnt": {
                    friendlyName: "Bind Name Cnt",
                    group: "ldap",
                    help: "Unique number of The bind name of ldap bind",
                    dbField2: "ldap.bindnameCnt",
                    type: "integer",
                    dbField: "ldap.bindnameCnt",
                    exp: "ldap.bindname.cnt",
                },
                "modbus.unitid": {
                    friendlyName: "Modbus Unit ID",
                    group: "modbus",
                    help: "Modbus Unit ID",
                    dbField2: "modbus.unitid",
                    type: "integer",
                    dbField: "modbus.unitid",
                    exp: "modbus.unitid",
                },
                "modbus.transactionid": {
                    friendlyName: "Modbus Transaction IDs",
                    group: "modbus",
                    help: "Modbus Transaction IDs",
                    dbField2: "modbus.transactionid",
                    type: "integer",
                    dbField: "modbus.transactionid",
                    exp: "modbus.transactionid",
                },
                "modbus.transactionidCnt": {
                    friendlyName: "Modbus Transaction IDs Cnt",
                    group: "modbus",
                    help: "Unique number of Modbus Transaction IDs",
                    dbField2: "modbus.transactionidCnt",
                    type: "integer",
                    dbField: "modbus.transactionidCnt",
                    exp: "modbus.transactionid.cnt",
                },
                "modbus.protocolid": {
                    friendlyName: "Modbus Protocol ID",
                    group: "modbus",
                    help: "Modbus Protocol ID (should always be 0)",
                    dbField2: "modbus.protocolid",
                    type: "integer",
                    dbField: "modbus.protocolid",
                    exp: "modbus.protocolid",
                },
                "modbus.funccode": {
                    friendlyName: "Modbus Function Code",
                    group: "modbus",
                    help: "Modbus Function Codes",
                    dbField2: "modbus.funccode",
                    type: "integer",
                    dbField: "modbus.funccode",
                    exp: "modbus.funccode",
                },
                "modbus.funccodeCnt": {
                    friendlyName: "Modbus Function Code Cnt",
                    group: "modbus",
                    help: "Unique number of Modbus Function Codes",
                    dbField2: "modbus.funccodeCnt",
                    type: "integer",
                    dbField: "modbus.funccodeCnt",
                    exp: "modbus.funccode.cnt",
                },
                "modbus.exccode": {
                    friendlyName: "Modbus Exception Code",
                    group: "modbus",
                    help: "Modbus Exception Codes",
                    dbField2: "modbus.exccode",
                    type: "integer",
                    dbField: "modbus.exccode",
                    exp: "modbus.exccode",
                },
                "modbus.exccodeCnt": {
                    friendlyName: "Modbus Exception Code Cnt",
                    group: "modbus",
                    help: "Unique number of Modbus Exception Codes",
                    dbField2: "modbus.exccodeCnt",
                    type: "integer",
                    dbField: "modbus.exccodeCnt",
                    exp: "modbus.exccode.cnt",
                },
                "mysql.user": {
                    friendlyName: "User",
                    group: "mysql",
                    help: "Mysql user name",
                    dbField2: "mysql.user",
                    type: "lotermfield",
                    category: "user",
                    dbField: "mysql.user",
                    exp: "mysql.user",
                },
                "mysql.version": {
                    friendlyName: "Version",
                    group: "mysql",
                    help: "Mysql server version string",
                    dbField2: "mysql.version",
                    type: "termfield",
                    dbField: "mysql.version",
                    exp: "mysql.ver",
                },
                "oracle.user": {
                    friendlyName: "User",
                    group: "oracle",
                    help: "Oracle User",
                    dbField2: "oracle.user",
                    type: "lotermfield",
                    category: "user",
                    dbField: "oracle.user",
                    exp: "oracle.user",
                },
                "oracle.host": {
                    friendlyName: "Host",
                    group: "oracle",
                    help: "Oracle Host",
                    dbField2: "oracle.host",
                    type: "lotermfield",
                    category: "host",
                    aliases: ["host.oracle"],
                    dbField: "oracle.host",
                    exp: "oracle.host",
                },
                "oracle.hostTokens": {
                    friendlyName: "Hostname Tokens",
                    group: "oracle",
                    help: "Oracle Hostname Tokens",
                    dbField2: "oracle.hostTokens",
                    type: "lotextfield",
                    aliases: ["host.oracle.tokens"],
                    dbField: "oracle.hostTokens",
                    exp: "oracle.host.tokens",
                },
                "oracle.service": {
                    friendlyName: "Service",
                    group: "oracle",
                    help: "Oracle Service",
                    dbField2: "oracle.service",
                    type: "lotermfield",
                    dbField: "oracle.service",
                    exp: "oracle.service",
                },
                "postgresql.user": {
                    friendlyName: "User",
                    group: "postgresql",
                    help: "Postgresql user name",
                    dbField2: "postgresql.user",
                    type: "termfield",
                    category: "user",
                    dbField: "postgresql.user",
                    exp: "postgresql.user",
                },
                "postgresql.db": {
                    friendlyName: "Database",
                    group: "postgresql",
                    help: "Postgresql database",
                    dbField2: "postgresql.db",
                    type: "termfield",
                    dbField: "postgresql.db",
                    exp: "postgresql.db",
                },
                "postgresql.app": {
                    friendlyName: "Application",
                    group: "postgresql",
                    help: "Postgresql application",
                    dbField2: "postgresql.app",
                    type: "termfield",
                    dbField: "postgresql.app",
                    exp: "postgresql.app",
                },
                "quic.host": {
                    friendlyName: "Hostname",
                    group: "quic",
                    help: "QUIC host header field",
                    dbField2: "quic.host",
                    type: "lotermfield",
                    category: "host",
                    aliases: ["quic.host"],
                    dbField: "quic.host",
                    exp: "host.quic",
                    transform: "removeProtocolAndURI",
                },
                "quic.hostCnt": {
                    friendlyName: "Hostname Cnt",
                    group: "quic",
                    help: "Unique number of QUIC host header field",
                    dbField2: "quic.hostCnt",
                    type: "integer",
                    dbField: "quic.hostCnt",
                    exp: "host.quic.cnt",
                    transform: "removeProtocolAndURI",
                },
                "quic.hostTokens": {
                    friendlyName: "Hostname Tokens",
                    group: "quic",
                    help: "QUIC host tokens header field",
                    dbField2: "quic.hostTokens",
                    type: "lotextfield",
                    aliases: ["quic.host.tokens"],
                    dbField: "quic.hostTokens",
                    exp: "host.quic.tokens",
                    transform: "removeProtocolAndURI",
                },
                "quic.useragent": {
                    friendlyName: "User-Agent",
                    group: "quic",
                    help: "User-Agent",
                    dbField2: "quic.useragent",
                    type: "termfield",
                    dbField: "quic.useragent",
                    exp: "quic.user-agent",
                },
                "quic.useragentCnt": {
                    friendlyName: "User-Agent Cnt",
                    group: "quic",
                    help: "Unique number of User-Agent",
                    dbField2: "quic.useragentCnt",
                    type: "integer",
                    dbField: "quic.useragentCnt",
                    exp: "quic.user-agent.cnt",
                },
                "quic.version": {
                    friendlyName: "Version",
                    group: "quic",
                    help: "QUIC Version",
                    dbField2: "quic.version",
                    type: "termfield",
                    dbField: "quic.version",
                    exp: "quic.version",
                },
                "quic.versionCnt": {
                    friendlyName: "Version Cnt",
                    group: "quic",
                    help: "Unique number of QUIC Version",
                    dbField2: "quic.versionCnt",
                    type: "integer",
                    dbField: "quic.versionCnt",
                    exp: "quic.version.cnt",
                },
                "radius.user": {
                    friendlyName: "User",
                    group: "radius",
                    help: "RADIUS user",
                    dbField2: "radius.user",
                    type: "termfield",
                    category: "user",
                    dbField: "radius.user",
                    exp: "radius.user",
                },
                "radius.mac": {
                    friendlyName: "MAC",
                    group: "radius",
                    help: "Radius Mac",
                    dbField2: "radius.mac",
                    type: "lotermfield",
                    dbField: "radius.mac",
                    exp: "radius.mac",
                },
                "radius.macCnt": {
                    friendlyName: "MAC Cnt",
                    group: "radius",
                    help: "Unique number of Radius Mac",
                    dbField2: "radius.macCnt",
                    type: "integer",
                    dbField: "radius.macCnt",
                    exp: "radius.mac.cnt",
                },
                "radius.endpointIp": {
                    friendlyName: "Endpoint IP",
                    group: "radius",
                    help: "Radius endpoint ip addresses for session",
                    dbField2: "radius.endpointIp",
                    type: "ip",
                    dbField: "radius.endpointIp",
                    exp: "radius.endpoint-ip",
                },
                "radius.endpointIpCnt": {
                    friendlyName: "Endpoint IP Cnt",
                    group: "radius",
                    help: "Unique number of Radius endpoint ip addresses for session",
                    dbField2: "radius.endpointIpCnt",
                    type: "integer",
                    dbField: "radius.endpointIpCnt",
                    exp: "radius.endpoint-ip.cnt",
                },
                "radius.endpointGEO": {
                    friendlyName: "Endpoint IP GEO",
                    group: "radius",
                    help: "GeoIP country string calculated from the Radius endpoint ip addresses for session",
                    dbField2: "radius.endpointGEO",
                    type: "uptermfield",
                    dbField: "radius.endpointGEO",
                    exp: "radius.endpoint-ip.country",
                },
                "radius.endpointASN": {
                    friendlyName: "Endpoint IP ASN",
                    group: "radius",
                    help: "GeoIP ASN string calculated from the Radius endpoint ip addresses for session",
                    dbField2: "radius.endpointASN",
                    type: "termfield",
                    dbField: "radius.endpointASN",
                    exp: "radius.endpoint-ip.asn",
                },
                "radius.endpointRIR": {
                    friendlyName: "Endpoint IP RIR",
                    group: "radius",
                    help: "Regional Internet Registry string calculated from Radius endpoint ip addresses for session",
                    dbField2: "radius.endpointRIR",
                    type: "uptermfield",
                    dbField: "radius.endpointRIR",
                    exp: "radius.endpoint-ip.rir",
                },
                "radius.framedIp": {
                    friendlyName: "Framed IP",
                    group: "radius",
                    help: "Radius framed ip addresses for session",
                    dbField2: "radius.framedIp",
                    type: "ip",
                    dbField: "radius.framedIp",
                    exp: "radius.framed-ip",
                },
                "radius.framedIpCnt": {
                    friendlyName: "Framed IP Cnt",
                    group: "radius",
                    help: "Unique number of Radius framed ip addresses for session",
                    dbField2: "radius.framedIpCnt",
                    type: "integer",
                    dbField: "radius.framedIpCnt",
                    exp: "radius.framed-ip.cnt",
                },
                "radius.framedGEO": {
                    friendlyName: "Framed IP GEO",
                    group: "radius",
                    help: "GeoIP country string calculated from the Radius framed ip addresses for session",
                    dbField2: "radius.framedGEO",
                    type: "uptermfield",
                    dbField: "radius.framedGEO",
                    exp: "radius.framed-ip.country",
                },
                "radius.framedASN": {
                    friendlyName: "Framed IP ASN",
                    group: "radius",
                    help: "GeoIP ASN string calculated from the Radius framed ip addresses for session",
                    dbField2: "radius.framedASN",
                    type: "termfield",
                    dbField: "radius.framedASN",
                    exp: "radius.framed-ip.asn",
                },
                "radius.framedRIR": {
                    friendlyName: "Framed IP RIR",
                    group: "radius",
                    help: "Regional Internet Registry string calculated from Radius framed ip addresses for session",
                    dbField2: "radius.framedRIR",
                    type: "uptermfield",
                    dbField: "radius.framedRIR",
                    exp: "radius.framed-ip.rir",
                },
                "smb.share": {
                    friendlyName: "Share",
                    group: "smb",
                    help: "SMB shares connected to",
                    dbField2: "smb.share",
                    type: "termfield",
                    dbField: "smb.share",
                    exp: "smb.share",
                },
                "smb.shareCnt": {
                    friendlyName: "Share Cnt",
                    group: "smb",
                    help: "Unique number of SMB shares connected to",
                    dbField2: "smb.shareCnt",
                    type: "integer",
                    dbField: "smb.shareCnt",
                    exp: "smb.share.cnt",
                },
                "smb.filename": {
                    friendlyName: "Filename",
                    group: "smb",
                    help: "SMB files opened, created, deleted",
                    dbField2: "smb.filename",
                    type: "termfield",
                    dbField: "smb.filename",
                    exp: "smb.fn",
                },
                "smb.filenameCnt": {
                    friendlyName: "Filename Cnt",
                    group: "smb",
                    help: "Unique number of SMB files opened, created, deleted",
                    dbField2: "smb.filenameCnt",
                    type: "integer",
                    dbField: "smb.filenameCnt",
                    exp: "smb.fn.cnt",
                },
                "smb.os": {
                    friendlyName: "OS",
                    group: "smb",
                    help: "SMB OS information",
                    dbField2: "smb.os",
                    type: "termfield",
                    dbField: "smb.os",
                    exp: "smb.os",
                },
                "smb.osCnt": {
                    friendlyName: "OS Cnt",
                    group: "smb",
                    help: "Unique number of SMB OS information",
                    dbField2: "smb.osCnt",
                    type: "integer",
                    dbField: "smb.osCnt",
                    exp: "smb.os.cnt",
                },
                "smb.domain": {
                    friendlyName: "Domain",
                    group: "smb",
                    help: "SMB domain",
                    dbField2: "smb.domain",
                    type: "termfield",
                    dbField: "smb.domain",
                    exp: "smb.domain",
                },
                "smb.domainCnt": {
                    friendlyName: "Domain Cnt",
                    group: "smb",
                    help: "Unique number of SMB domain",
                    dbField2: "smb.domainCnt",
                    type: "integer",
                    dbField: "smb.domainCnt",
                    exp: "smb.domain.cnt",
                },
                "smb.version": {
                    friendlyName: "Version",
                    group: "smb",
                    help: "SMB Version information",
                    dbField2: "smb.version",
                    type: "termfield",
                    dbField: "smb.version",
                    exp: "smb.ver",
                },
                "smb.versionCnt": {
                    friendlyName: "Version Cnt",
                    group: "smb",
                    help: "Unique number of SMB Version information",
                    dbField2: "smb.versionCnt",
                    type: "integer",
                    dbField: "smb.versionCnt",
                    exp: "smb.ver.cnt",
                },
                "smb.user": {
                    friendlyName: "User",
                    group: "smb",
                    help: "SMB User",
                    dbField2: "smb.user",
                    type: "termfield",
                    category: "user",
                    dbField: "smb.user",
                    exp: "smb.user",
                },
                "smb.userCnt": {
                    friendlyName: "User Cnt",
                    group: "smb",
                    help: "Unique number of SMB User",
                    dbField2: "smb.userCnt",
                    type: "integer",
                    dbField: "smb.userCnt",
                    exp: "smb.user.cnt",
                },
                "smb.host": {
                    friendlyName: "Hostname",
                    group: "smb",
                    help: "SMB Host name",
                    dbField2: "smb.host",
                    type: "termfield",
                    category: "host",
                    aliases: ["smb.host"],
                    dbField: "smb.host",
                    exp: "host.smb",
                    transform: "removeProtocolAndURI",
                },
                "smb.hostCnt": {
                    friendlyName: "Hostname Cnt",
                    group: "smb",
                    help: "Unique number of SMB Host name",
                    dbField2: "smb.hostCnt",
                    type: "integer",
                    dbField: "smb.hostCnt",
                    exp: "host.smb.cnt",
                    transform: "removeProtocolAndURI",
                },
                "smb.hostTokens": {
                    friendlyName: "Hostname Tokens",
                    group: "smb",
                    help: "SMB Host Tokens",
                    dbField2: "smb.hostTokens",
                    type: "lotextfield",
                    aliases: ["smb.host.tokens"],
                    dbField: "smb.hostTokens",
                    exp: "host.smb.tokens",
                    transform: "removeProtocolAndURI",
                },
                "email.host": {
                    friendlyName: "Hostname",
                    group: "email",
                    help: "Email hostnames",
                    dbField2: "email.host",
                    type: "lotermfield",
                    aliases: ["email.host"],
                    requiredRight: "emailSearch",
                    category: "host",
                    dbField: "email.host",
                    exp: "host.email",
                    transform: "removeProtocolAndURI",
                },
                "email.hostCnt": {
                    friendlyName: "Hostname Cnt",
                    group: "email",
                    help: "Unique number of Email hostnames",
                    dbField2: "email.hostCnt",
                    type: "integer",
                    dbField: "email.hostCnt",
                    exp: "host.email.cnt",
                    transform: "removeProtocolAndURI",
                },
                "email.hostTokens": {
                    friendlyName: "Hostname Tokens",
                    group: "email",
                    help: "Email Hostname Tokens",
                    dbField2: "email.hostTokens",
                    type: "lotextfield",
                    aliases: ["email.host.tokens"],
                    requiredRight: "emailSearch",
                    dbField: "email.hostTokens",
                    exp: "host.email.tokens",
                    transform: "removeProtocolAndURI",
                },
                "email.useragent": {
                    friendlyName: "X-Mailer Header",
                    group: "email",
                    help: "Email X-Mailer header",
                    dbField2: "email.useragent",
                    type: "termfield",
                    requiredRight: "emailSearch",
                    dbField: "email.useragent",
                    exp: "email.x-mailer",
                },
                "email.useragentCnt": {
                    friendlyName: "X-Mailer Header Cnt",
                    group: "email",
                    help: "Unique number of Email X-Mailer header",
                    dbField2: "email.useragentCnt",
                    type: "integer",
                    dbField: "email.useragentCnt",
                    exp: "email.x-mailer.cnt",
                },
                "email.src": {
                    friendlyName: "Sender",
                    group: "email",
                    help: "Email from address",
                    dbField2: "email.src",
                    type: "lotermfield",
                    requiredRight: "emailSearch",
                    category: "user",
                    dbField: "email.src",
                    exp: "email.src",
                },
                "email.srcCnt": {
                    friendlyName: "Sender Cnt",
                    group: "email",
                    help: "Unique number of Email from address",
                    dbField2: "email.srcCnt",
                    type: "integer",
                    dbField: "email.srcCnt",
                    exp: "email.src.cnt",
                },
                "email.dst": {
                    friendlyName: "Receiver",
                    group: "email",
                    help: "Email to address",
                    dbField2: "email.dst",
                    type: "lotermfield",
                    requiredRight: "emailSearch",
                    category: "user",
                    dbField: "email.dst",
                    exp: "email.dst",
                },
                "email.dstCnt": {
                    friendlyName: "Receiver Cnt",
                    group: "email",
                    help: "Unique number of Email to address",
                    dbField2: "email.dstCnt",
                    type: "integer",
                    dbField: "email.dstCnt",
                    exp: "email.dst.cnt",
                },
                "email.subject": {
                    friendlyName: "Subject",
                    group: "email",
                    help: "Email subject header",
                    dbField2: "email.subject",
                    type: "termfield",
                    requiredRight: "emailSearch",
                    dbField: "email.subject",
                    exp: "email.subject",
                },
                "email.subjectCnt": {
                    friendlyName: "Subject Cnt",
                    group: "email",
                    help: "Unique number of Email subject header",
                    dbField2: "email.subjectCnt",
                    type: "integer",
                    dbField: "email.subjectCnt",
                    exp: "email.subject.cnt",
                },
                "email.id": {
                    friendlyName: "Id",
                    group: "email",
                    help: "Email Message-Id header",
                    dbField2: "email.id",
                    type: "termfield",
                    requiredRight: "emailSearch",
                    dbField: "email.id",
                    exp: "email.message-id",
                },
                "email.idCnt": {
                    friendlyName: "Id Cnt",
                    group: "email",
                    help: "Unique number of Email Message-Id header",
                    dbField2: "email.idCnt",
                    type: "integer",
                    dbField: "email.idCnt",
                    exp: "email.message-id.cnt",
                },
                "email.contentType": {
                    friendlyName: "Content-Type",
                    group: "email",
                    help: "Email content-type header",
                    dbField2: "email.contentType",
                    type: "termfield",
                    dbField: "email.contentType",
                    exp: "email.content-type",
                },
                "email.contentTypeCnt": {
                    friendlyName: "Content-Type Cnt",
                    group: "email",
                    help: "Unique number of Email content-type header",
                    dbField2: "email.contentTypeCnt",
                    type: "integer",
                    dbField: "email.contentTypeCnt",
                    exp: "email.content-type.cnt",
                },
                "email.mimeVersion": {
                    friendlyName: "Mime-Version",
                    group: "email",
                    help: "Email Mime-Header header",
                    dbField2: "email.mimeVersion",
                    type: "termfield",
                    dbField: "email.mimeVersion",
                    exp: "email.mime-version",
                },
                "email.mimeVersionCnt": {
                    friendlyName: "Mime-Version Cnt",
                    group: "email",
                    help: "Unique number of Email Mime-Header header",
                    dbField2: "email.mimeVersionCnt",
                    type: "integer",
                    dbField: "email.mimeVersionCnt",
                    exp: "email.mime-version.cnt",
                },
                "email.filename": {
                    friendlyName: "Filenames",
                    group: "email",
                    help: "Email attachment filenames",
                    dbField2: "email.filename",
                    type: "termfield",
                    requiredRight: "emailSearch",
                    dbField: "email.filename",
                    exp: "email.fn",
                },
                "email.filenameCnt": {
                    friendlyName: "Filenames Cnt",
                    group: "email",
                    help: "Unique number of Email attachment filenames",
                    dbField2: "email.filenameCnt",
                    type: "integer",
                    dbField: "email.filenameCnt",
                    exp: "email.fn.cnt",
                },
                "email.md5": {
                    friendlyName: "Attach MD5s",
                    group: "email",
                    help: "Email attachment MD5s",
                    dbField2: "email.md5",
                    type: "termfield",
                    requiredRight: "emailSearch",
                    category: "md5",
                    dbField: "email.md5",
                    exp: "email.md5",
                },
                "email.md5Cnt": {
                    friendlyName: "Attach MD5s Cnt",
                    group: "email",
                    help: "Unique number of Email attachment MD5s",
                    dbField2: "email.md5Cnt",
                    type: "integer",
                    dbField: "email.md5Cnt",
                    exp: "email.md5.cnt",
                },
                "email.fileContentType": {
                    friendlyName: "Attach Content-Type",
                    group: "email",
                    help: "Email attachment content types",
                    dbField2: "email.fileContentType",
                    type: "termfield",
                    requiredRight: "emailSearch",
                    dbField: "email.fileContentType",
                    exp: "email.file-content-type",
                },
                "email.fileContentTypeCnt": {
                    friendlyName: "Attach Content-Type Cnt",
                    group: "email",
                    help: "Unique number of Email attachment content types",
                    dbField2: "email.fileContentTypeCnt",
                    type: "integer",
                    dbField: "email.fileContentTypeCnt",
                    exp: "email.file-content-type.cnt",
                },
                "email.ip": {
                    friendlyName: "IP",
                    group: "email",
                    help: "Email IP address",
                    dbField2: "email.ip",
                    type: "ip",
                    requiredRight: "emailSearch",
                    category: "ip",
                    dbField: "email.ip",
                    exp: "ip.email",
                },
                "email.ipCnt": {
                    friendlyName: "IP Cnt",
                    group: "email",
                    help: "Unique number of Email IP address",
                    dbField2: "email.ipCnt",
                    type: "integer",
                    dbField: "email.ipCnt",
                    exp: "ip.email.cnt",
                },
                "email.GEO": {
                    friendlyName: " GEO",
                    group: "email",
                    help: "GeoIP country string calculated from the Email IP address",
                    dbField2: "email.GEO",
                    type: "uptermfield",
                    dbField: "email.GEO",
                    exp: "country.email",
                },
                "email.ASN": {
                    friendlyName: " ASN",
                    group: "email",
                    help: "GeoIP ASN string calculated from the Email IP address",
                    dbField2: "email.ASN",
                    type: "termfield",
                    dbField: "email.ASN",
                    exp: "asn.email",
                },
                "email.RIR": {
                    friendlyName: " RIR",
                    group: "email",
                    help: "Regional Internet Registry string calculated from Email IP address",
                    dbField2: "email.RIR",
                    type: "uptermfield",
                    dbField: "email.RIR",
                    exp: "rir.email",
                },
                "email.header": {
                    friendlyName: "Header",
                    group: "email",
                    help: "Email has the header set",
                    dbField2: "email.header",
                    type: "lotermfield",
                    requiredRight: "emailSearch",
                    dbField: "email.header",
                    exp: "email.has-header",
                },
                "email.headerCnt": {
                    friendlyName: "Header Cnt",
                    group: "email",
                    help: "Unique number of Email has the header set",
                    dbField2: "email.headerCnt",
                    type: "integer",
                    dbField: "email.headerCnt",
                    exp: "email.has-header.cnt",
                },
                "email.headerValue": {
                    friendlyName: "Header Value",
                    group: "email",
                    help: "Email has the header value",
                    dbField2: "email.headerValue",
                    type: "termfield",
                    requiredRight: "emailSearch",
                    dbField: "email.headerValue",
                    exp: "email.has-header.value",
                },
                "email.headerValueCnt": {
                    friendlyName: "Header Value Cnt",
                    group: "email",
                    help: "Unique number of Email has the header value",
                    dbField2: "email.headerValueCnt",
                    type: "integer",
                    dbField: "email.headerValueCnt",
                    exp: "email.has-header.value.cnt",
                },
                "email.bodyMagic": {
                    friendlyName: "Body Magic",
                    group: "email",
                    help: "The content type of body determined by libfile/magic",
                    dbField2: "email.bodyMagic",
                    type: "termfield",
                    dbField: "email.bodyMagic",
                    exp: "email.bodymagic",
                },
                "email.bodyMagicCnt": {
                    friendlyName: "Body Magic Cnt",
                    group: "email",
                    help: "Unique number of The content type of body determined by libfile/magic",
                    dbField2: "email.bodyMagicCnt",
                    type: "integer",
                    dbField: "email.bodyMagicCnt",
                    exp: "email.bodymagic.cnt",
                },
                "email.smtpHello": {
                    friendlyName: "SMTP Hello",
                    group: "email",
                    help: "SMTP HELO/EHLO",
                    dbField2: "email.smtpHello",
                    type: "lotermfield",
                    dbField: "email.smtpHello",
                    exp: "email.smtp-hello",
                },
                "email.smtpHelloCnt": {
                    friendlyName: "SMTP Hello Cnt",
                    group: "email",
                    help: "Unique number of SMTP HELO/EHLO",
                    dbField2: "email.smtpHelloCnt",
                    type: "integer",
                    dbField: "email.smtpHelloCnt",
                    exp: "email.smtp-hello.cnt",
                },
                "email.header-x-priority": {
                    friendlyName: "email.x-priority",
                    group: "email",
                    help: "Email header x-priority",
                    dbField2: "email.header-x-priority",
                    type: "integer",
                    dbField: "email.header-x-priority",
                    exp: "email.x-priority",
                },
                "email.header-authorization": {
                    friendlyName: "email.authorization",
                    group: "email",
                    help: "Email header authorization",
                    dbField2: "email.header-authorization",
                    type: "termfield",
                    dbField: "email.header-authorization",
                    exp: "email.authorization",
                },
                "snmp.version": {
                    friendlyName: "Version",
                    group: "snmp",
                    help: "SNMP Version",
                    dbField2: "snmp.version",
                    type: "integer",
                    dbField: "snmp.version",
                    exp: "snmp.version",
                },
                "snmp.versionCnt": {
                    friendlyName: "Version Cnt",
                    group: "snmp",
                    help: "Unique number of SNMP Version",
                    dbField2: "snmp.versionCnt",
                    type: "integer",
                    dbField: "snmp.versionCnt",
                    exp: "snmp.version.cnt",
                },
                "snmp.community": {
                    friendlyName: "Community",
                    group: "snmp",
                    help: "SNMP Community",
                    dbField2: "snmp.community",
                    type: "termfield",
                    dbField: "snmp.community",
                    exp: "snmp.community",
                },
                "snmp.communityCnt": {
                    friendlyName: "Community Cnt",
                    group: "snmp",
                    help: "Unique number of SNMP Community",
                    dbField2: "snmp.communityCnt",
                    type: "integer",
                    dbField: "snmp.communityCnt",
                    exp: "snmp.community.cnt",
                },
                "snmp.error": {
                    friendlyName: "Error Code",
                    group: "snmp",
                    help: "SNMP Error Code",
                    dbField2: "snmp.error",
                    type: "integer",
                    dbField: "snmp.error",
                    exp: "snmp.error",
                },
                "snmp.errorCnt": {
                    friendlyName: "Error Code Cnt",
                    group: "snmp",
                    help: "Unique number of SNMP Error Code",
                    dbField2: "snmp.errorCnt",
                    type: "integer",
                    dbField: "snmp.errorCnt",
                    exp: "snmp.error.cnt",
                },
                "snmp.variable": {
                    friendlyName: "Variable",
                    group: "snmp",
                    help: "SNMP Variable",
                    dbField2: "snmp.variable",
                    type: "termfield",
                    dbField: "snmp.variable",
                    exp: "snmp.variable",
                },
                "snmp.variableCnt": {
                    friendlyName: "Variable Cnt",
                    group: "snmp",
                    help: "Unique number of SNMP Variable",
                    dbField2: "snmp.variableCnt",
                    type: "integer",
                    dbField: "snmp.variableCnt",
                    exp: "snmp.variable.cnt",
                },
                "snmp.type": {
                    friendlyName: "Type",
                    group: "snmp",
                    help: "SNMP Type",
                    dbField2: "snmp.type",
                    type: "termfield",
                    dbField: "snmp.type",
                    exp: "snmp.type",
                },
                "snmp.typeCnt": {
                    friendlyName: "Type Cnt",
                    group: "snmp",
                    help: "Unique number of SNMP Type",
                    dbField2: "snmp.typeCnt",
                    type: "integer",
                    dbField: "snmp.typeCnt",
                    exp: "snmp.type.cnt",
                },
                "socks.ip": {
                    friendlyName: "IP",
                    group: "socks",
                    help: "SOCKS destination IP",
                    dbField2: "socks.ip",
                    type: "ip",
                    aliases: ["socks.ip"],
                    portField: "socks.port",
                    portField2: "socks.port",
                    dbField: "socks.ip",
                    exp: "ip.socks",
                },
                "socks.GEO": {
                    friendlyName: " GEO",
                    group: "socks",
                    help: "GeoIP country string calculated from the SOCKS destination IP",
                    dbField2: "socks.GEO",
                    type: "uptermfield",
                    dbField: "socks.GEO",
                    exp: "country.socks",
                },
                "socks.ASN": {
                    friendlyName: " ASN",
                    group: "socks",
                    help: "GeoIP ASN string calculated from the SOCKS destination IP",
                    dbField2: "socks.ASN",
                    type: "termfield",
                    dbField: "socks.ASN",
                    exp: "asn.socks",
                },
                "socks.RIR": {
                    friendlyName: " RIR",
                    group: "socks",
                    help: "Regional Internet Registry string calculated from SOCKS destination IP",
                    dbField2: "socks.RIR",
                    type: "uptermfield",
                    dbField: "socks.RIR",
                    exp: "rir.socks",
                },
                "socks.host": {
                    friendlyName: "Host",
                    group: "socks",
                    help: "SOCKS destination host",
                    dbField2: "socks.host",
                    type: "lotermfield",
                    aliases: ["socks.host"],
                    category: "host",
                    dbField: "socks.host",
                    exp: "host.socks",
                    transform: "removeProtocolAndURI",
                },
                "socks.hostTokens": {
                    friendlyName: "Hostname Tokens",
                    group: "socks",
                    help: "SOCKS Hostname Tokens",
                    dbField2: "socks.hostTokens",
                    type: "lotextfield",
                    aliases: ["socks.host.tokens"],
                    dbField: "socks.hostTokens",
                    exp: "host.socks.tokens",
                    transform: "removeProtocolAndURI",
                },
                "socks.port": {
                    friendlyName: "Port",
                    group: "socks",
                    help: "SOCKS destination port",
                    dbField2: "socks.port",
                    type: "integer",
                    aliases: ["socks.port"],
                    category: "port",
                    dbField: "socks.port",
                    exp: "port.socks",
                },
                "socks.user": {
                    friendlyName: "User",
                    group: "socks",
                    help: "SOCKS authenticated user",
                    dbField2: "socks.user",
                    type: "termfield",
                    aliases: ["socksuser"],
                    category: "user",
                    dbField: "socks.user",
                    exp: "socks.user",
                },
                "ssh.version": {
                    friendlyName: "Version",
                    group: "ssh",
                    help: "SSH Software Version",
                    dbField2: "ssh.version",
                    type: "lotermfield",
                    dbField: "ssh.version",
                    exp: "ssh.ver",
                },
                "ssh.versionCnt": {
                    friendlyName: "Version Cnt",
                    group: "ssh",
                    help: "Unique number of SSH Software Version",
                    dbField2: "ssh.versionCnt",
                    type: "integer",
                    dbField: "ssh.versionCnt",
                    exp: "ssh.ver.cnt",
                },
                "ssh.key": {
                    friendlyName: "Key",
                    group: "ssh",
                    help: "SSH Key",
                    dbField2: "ssh.key",
                    type: "termfield",
                    dbField: "ssh.key",
                    exp: "ssh.key",
                },
                "ssh.keyCnt": {
                    friendlyName: "Key Cnt",
                    group: "ssh",
                    help: "Unique number of SSH Key",
                    dbField2: "ssh.keyCnt",
                    type: "integer",
                    dbField: "ssh.keyCnt",
                    exp: "ssh.key.cnt",
                },
                "ssh.hassh": {
                    friendlyName: "HASSH",
                    group: "ssh",
                    help: "SSH HASSH field",
                    dbField2: "ssh.hassh",
                    type: "lotermfield",
                    dbField: "ssh.hassh",
                    exp: "ssh.hassh",
                },
                "ssh.hasshCnt": {
                    friendlyName: "HASSH Cnt",
                    group: "ssh",
                    help: "Unique number of SSH HASSH field",
                    dbField2: "ssh.hasshCnt",
                    type: "integer",
                    dbField: "ssh.hasshCnt",
                    exp: "ssh.hassh.cnt",
                },
                "ssh.hasshServer": {
                    friendlyName: "HASSH Server",
                    group: "ssh",
                    help: "SSH HASSH Server field",
                    dbField2: "ssh.hasshServer",
                    type: "lotermfield",
                    dbField: "ssh.hasshServer",
                    exp: "ssh.hasshServer",
                },
                "ssh.hasshServerCnt": {
                    friendlyName: "HASSH Server Cnt",
                    group: "ssh",
                    help: "Unique number of SSH HASSH Server field",
                    dbField2: "ssh.hasshServerCnt",
                    type: "integer",
                    dbField: "ssh.hasshServerCnt",
                    exp: "ssh.hasshServer.cnt",
                },
                certCnt: {
                    friendlyName: "Cert Cnt",
                    group: "cert",
                    help: "Count of certificates",
                    dbField2: "certCnt",
                    type: "integer",
                    dbField: "certCnt",
                    exp: "cert.cnt",
                },
                "cert.alt": {
                    friendlyName: "Alt Name",
                    group: "cert",
                    help: "Certificate alternative names",
                    dbField2: "cert.alt",
                    type: "lotermfield",
                    dbField: "cert.alt",
                    exp: "cert.alt",
                },
                "cert.altCnt": {
                    friendlyName: "Alt Name Cnt",
                    group: "cert",
                    help: "Unique number of Certificate alternative names",
                    dbField2: "cert.altCnt",
                    type: "integer",
                    dbField: "cert.altCnt",
                    exp: "cert.alt.cnt",
                },
                "cert.serial": {
                    friendlyName: "Serial Number",
                    group: "cert",
                    help: "Serial Number",
                    dbField2: "cert.serial",
                    type: "lotermfield",
                    dbField: "cert.serial",
                    exp: "cert.serial",
                },
                "cert.issuerCN": {
                    friendlyName: "Issuer CN",
                    group: "cert",
                    help: "Issuer's common name",
                    dbField2: "cert.issuerCN",
                    type: "lotermfield",
                    dbField: "cert.issuerCN",
                    exp: "cert.issuer.cn",
                },
                "cert.subjectCN": {
                    friendlyName: "Subject CN",
                    group: "cert",
                    help: "Subject's common name",
                    dbField2: "cert.subjectCN",
                    type: "lotermfield",
                    dbField: "cert.subjectCN",
                    exp: "cert.subject.cn",
                },
                "cert.issuerON": {
                    friendlyName: "Issuer ON",
                    group: "cert",
                    help: "Issuer's organization name",
                    dbField2: "cert.issuerON",
                    type: "termfield",
                    dbField: "cert.issuerON",
                    exp: "cert.issuer.on",
                },
                "cert.subjectON": {
                    friendlyName: "Subject ON",
                    group: "cert",
                    help: "Subject's organization name",
                    dbField2: "cert.subjectON",
                    type: "termfield",
                    dbField: "cert.subjectON",
                    exp: "cert.subject.on",
                },
                "cert.issuerOU": {
                    friendlyName: "Issuer Org Unit",
                    group: "cert",
                    help: "Issuer's organizational unit",
                    dbField2: "cert.issuerOU",
                    type: "termfield",
                    dbField: "cert.issuerOU",
                    exp: "cert.issuer.ou",
                },
                "cert.subjectOU": {
                    friendlyName: "Subject Org Unit",
                    group: "cert",
                    help: "Subject's organizational unit",
                    dbField2: "cert.subjectOU",
                    type: "termfield",
                    dbField: "cert.subjectOU",
                    exp: "cert.subject.ou",
                },
                "cert.hash": {
                    friendlyName: "Hash",
                    group: "cert",
                    help: "SHA1 hash of entire certificate",
                    dbField2: "cert.hash",
                    type: "lotermfield",
                    dbField: "cert.hash",
                    exp: "cert.hash",
                },
                "cert.notBefore": {
                    friendlyName: "Not Before",
                    group: "cert",
                    help: "Certificate is not valid before this date",
                    dbField2: "cert.notBefore",
                    type: "date",
                    dbField: "cert.notBefore",
                    exp: "cert.notbefore",
                },
                "cert.notAfter": {
                    friendlyName: "Not After",
                    group: "cert",
                    help: "Certificate is not valid after this date",
                    dbField2: "cert.notAfter",
                    type: "date",
                    dbField: "cert.notAfter",
                    exp: "cert.notafter",
                },
                "cert.validDays": {
                    friendlyName: "Days Valid For",
                    group: "cert",
                    help: "Certificate is valid for this many days total",
                    dbField2: "cert.validDays",
                    type: "integer",
                    dbField: "cert.validDays",
                    exp: "cert.validfor",
                },
                "cert.remainingDays": {
                    friendlyName: "Days remaining",
                    group: "cert",
                    help: "Certificate is still valid for this many days",
                    dbField2: "cert.remainingDays",
                    type: "integer",
                    dbField: "cert.remainingDays",
                    exp: "cert.remainingDays",
                },
                "cert.validSeconds": {
                    friendlyName: "Seconds Valid For",
                    group: "cert",
                    help: "Certificate is valid for this many seconds total",
                    dbField2: "cert.validSeconds",
                    type: "integer",
                    dbField: "cert.validSeconds",
                    exp: "cert.validforSeconds",
                },
                "cert.remainingSeconds": {
                    friendlyName: "Seconds remaining",
                    group: "cert",
                    help: "Certificate is still valid for this many seconds",
                    dbField2: "cert.remainingSeconds",
                    type: "integer",
                    dbField: "cert.remainingSeconds",
                    exp: "cert.remainingSeconds",
                },
                "cert.curve": {
                    friendlyName: "Curve",
                    group: "cert",
                    help: "Curve Algorithm",
                    dbField2: "cert.curve",
                    type: "termfield",
                    dbField: "cert.curve",
                    exp: "cert.curve",
                },
                "cert.publicAlgorithm": {
                    friendlyName: "Public Algorithm",
                    group: "cert",
                    help: "Public Key Algorithm",
                    dbField2: "cert.publicAlgorithm",
                    type: "termfield",
                    dbField: "cert.publicAlgorithm",
                    exp: "cert.publicAlgorithm",
                },
                "tls.version": {
                    friendlyName: "Version",
                    group: "tls",
                    help: "SSL/TLS version field",
                    dbField2: "tls.version",
                    type: "termfield",
                    dbField: "tls.version",
                    exp: "tls.version",
                },
                "tls.versionCnt": {
                    friendlyName: "Version Cnt",
                    group: "tls",
                    help: "Unique number of SSL/TLS version field",
                    dbField2: "tls.versionCnt",
                    type: "integer",
                    dbField: "tls.versionCnt",
                    exp: "tls.version.cnt",
                },
                "tls.cipher": {
                    friendlyName: "Cipher",
                    group: "tls",
                    help: "SSL/TLS cipher field",
                    dbField2: "tls.cipher",
                    type: "uptermfield",
                    dbField: "tls.cipher",
                    exp: "tls.cipher",
                },
                "tls.cipherCnt": {
                    friendlyName: "Cipher Cnt",
                    group: "tls",
                    help: "Unique number of SSL/TLS cipher field",
                    dbField2: "tls.cipherCnt",
                    type: "integer",
                    dbField: "tls.cipherCnt",
                    exp: "tls.cipher.cnt",
                },
                "tls.ja3": {
                    friendlyName: "JA3",
                    group: "tls",
                    help: "SSL/TLS JA3 field",
                    dbField2: "tls.ja3",
                    type: "lotermfield",
                    dbField: "tls.ja3",
                    exp: "tls.ja3",
                },
                "tls.ja3Cnt": {
                    friendlyName: "JA3 Cnt",
                    group: "tls",
                    help: "Unique number of SSL/TLS JA3 field",
                    dbField2: "tls.ja3Cnt",
                    type: "integer",
                    dbField: "tls.ja3Cnt",
                    exp: "tls.ja3.cnt",
                },
                "tls.ja4": {
                    friendlyName: "JA4",
                    group: "tls",
                    help: "SSL/TLS JA4 field",
                    dbField2: "tls.ja4",
                    type: "lotermfield",
                    dbField: "tls.ja4",
                    exp: "tls.ja4",
                },
                "tls.ja4Cnt": {
                    friendlyName: "JA4 Cnt",
                    group: "tls",
                    help: "Unique number of SSL/TLS JA4 field",
                    dbField2: "tls.ja4Cnt",
                    type: "integer",
                    dbField: "tls.ja4Cnt",
                    exp: "tls.ja4.cnt",
                },
                "tls.ja4_r": {
                    friendlyName: "JA4_r",
                    group: "tls",
                    help: "SSL/TLS JA4_r field",
                    dbField2: "tls.ja4_r",
                    type: "lotermfield",
                    dbField: "tls.ja4_r",
                    exp: "tls.ja4_r",
                },
                "tls.ja4_rCnt": {
                    friendlyName: "JA4_r Cnt",
                    group: "tls",
                    help: "Unique number of SSL/TLS JA4_r field",
                    dbField2: "tls.ja4_rCnt",
                    type: "integer",
                    dbField: "tls.ja4_rCnt",
                    exp: "tls.ja4_r.cnt",
                },
                "tls.ja3s": {
                    friendlyName: "JA3S",
                    group: "tls",
                    help: "SSL/TLS JA3S field",
                    dbField2: "tls.ja3s",
                    type: "lotermfield",
                    dbField: "tls.ja3s",
                    exp: "tls.ja3s",
                },
                "tls.ja3sCnt": {
                    friendlyName: "JA3S Cnt",
                    group: "tls",
                    help: "Unique number of SSL/TLS JA3S field",
                    dbField2: "tls.ja3sCnt",
                    type: "integer",
                    dbField: "tls.ja3sCnt",
                    exp: "tls.ja3s.cnt",
                },
                "tls.dstSessionId": {
                    friendlyName: "Dst Session Id",
                    group: "tls",
                    help: "SSL/TLS Dst Session Id",
                    dbField2: "tls.dstSessionId",
                    type: "lotermfield",
                    dbField: "tls.dstSessionId",
                    exp: "tls.sessionid.dst",
                },
                "tls.srcSessionId": {
                    friendlyName: "Src Session Id",
                    group: "tls",
                    help: "SSL/TLS Src Session Id",
                    dbField2: "tls.srcSessionId",
                    type: "lotermfield",
                    dbField: "tls.srcSessionId",
                    exp: "tls.sessionid.src",
                },
                tlsidall: {
                    friendlyName: "Src or Dst Session Id",
                    group: "general",
                    help: "Shorthand for tls.sessionid.src or tls.sessionid.dst",
                    dbField2: "tlsidall",
                    type: "lotermfield",
                    regex: "^tls\\.sessionid\\.(?:(?!\\.cnt$).)*$",
                    dbField: "tlsidall",
                    exp: "tls.sessionid",
                },
                tags: {
                    friendlyName: "Tags",
                    group: "general",
                    help: "Tags set for session",
                    dbField2: "tags",
                    type: "termfield",
                    dbField: "tags",
                    exp: "tags",
                },
                tagsCnt: {
                    friendlyName: "Tags Cnt",
                    group: "general",
                    help: "Unique number of Tags set for session",
                    dbField2: "tagsCnt",
                    type: "integer",
                    dbField: "tagsCnt",
                    exp: "tags.cnt",
                },
                asset: {
                    friendlyName: "Asset",
                    group: "general",
                    help: "Asset name",
                    dbField2: "asset",
                    type: "lotermfield",
                    dbField: "asset",
                    exp: "asset",
                },
                assetCnt: {
                    friendlyName: "Asset Cnt",
                    group: "general",
                    help: "Unique number of Asset name",
                    dbField2: "assetCnt",
                    type: "integer",
                    dbField: "assetCnt",
                    exp: "asset.cnt",
                },
                protocol: {
                    friendlyName: "Protocols",
                    group: "general",
                    help: "Protocols set for session",
                    dbField2: "protocol",
                    type: "termfield",
                    dbField: "protocol",
                    exp: "protocols",
                },
                protocolCnt: {
                    friendlyName: "Protocols Cnt",
                    group: "general",
                    help: "Unique number of Protocols set for session",
                    dbField2: "protocolCnt",
                    type: "integer",
                    dbField: "protocolCnt",
                    exp: "protocols.cnt",
                },
                "source.packets": {
                    friendlyName: "Src Packets",
                    group: "general",
                    help: "Total number of packets sent by source in a session",
                    dbField2: "srcPackets",
                    type: "integer",
                    fieldECS: "source.packets",
                    dbField: "source.packets",
                    exp: "packets.src",
                },
                srcPackets: {
                    friendlyName: "Src Packets",
                    group: "general",
                    help: "Total number of packets sent by source in a session",
                    dbField2: "srcPackets",
                    type: "integer",
                    fieldECS: "source.packets",
                    dbField: "source.packets",
                    exp: "packets.src",
                },
                "destination.packets": {
                    friendlyName: "Dst Packets",
                    group: "general",
                    help: "Total number of packets sent by destination in a session",
                    dbField2: "dstPackets",
                    type: "integer",
                    fieldECS: "destination.packets",
                    dbField: "destination.packets",
                    exp: "packets.dst",
                },
                dstPackets: {
                    friendlyName: "Dst Packets",
                    group: "general",
                    help: "Total number of packets sent by destination in a session",
                    dbField2: "dstPackets",
                    type: "integer",
                    fieldECS: "destination.packets",
                    dbField: "destination.packets",
                    exp: "packets.dst",
                },
                "network.community_id": {
                    friendlyName: "Community Id",
                    group: "general",
                    help: "Community id flow hash",
                    dbField2: "communityId",
                    type: "termfield",
                    fieldECS: "network.community_id",
                    dbField: "network.community_id",
                    exp: "communityId",
                },
                communityId: {
                    friendlyName: "Community Id",
                    group: "general",
                    help: "Community id flow hash",
                    dbField2: "communityId",
                    type: "termfield",
                    fieldECS: "network.community_id",
                    dbField: "network.community_id",
                    exp: "communityId",
                },
            },
            prefix: "arkime_",
            emailSearch: false,
            shortcuts: {},
            shortcutTypeMap: {
                ip: "ip",
                integer: "number",
                termfield: "string",
                uptermfield: "string",
                lotermfield: "string",
            },
        },
        symbols_: {
            error: 2,
            expressions: 3,
            e: 4,
            EOF: 5,
            OP: 6,
            lt: 7,
            lte: 8,
            gt: 9,
            gte: 10,
            "==": 11,
            "!=": 12,
            VALUE: 13,
            STR: 14,
            QUOTEDSTR: 15,
            REGEXSTR: 16,
            LIST: 17,
            "&&": 18,
            "||": 19,
            "!": 20,
            "-": 21,
            "(": 22,
            ")": 23,
            EXISTS: 24,
            $accept: 0,
            $end: 1,
        },
        terminals_: {
            2: "error",
            5: "EOF",
            7: "lt",
            8: "lte",
            9: "gt",
            10: "gte",
            11: "==",
            12: "!=",
            14: "STR",
            15: "QUOTEDSTR",
            16: "REGEXSTR",
            17: "LIST",
            18: "&&",
            19: "||",
            20: "!",
            21: "-",
            22: "(",
            23: ")",
            24: "EXISTS",
        },
        productions_: [
            0,
            [3, 2],
            [6, 1],
            [6, 1],
            [6, 1],
            [6, 1],
            [6, 1],
            [6, 1],
            [13, 1],
            [13, 1],
            [13, 1],
            [13, 1],
            [4, 3],
            [4, 3],
            [4, 2],
            [4, 2],
            [4, 3],
            [4, 3],
            [4, 3],
            [4, 3],
        ],
        performAction: function anonymous(
            yytext,
            yyleng,
            yylineno,
            yy,
            yystate,
            $$,
            _$
        ) {
            const $0 = $$.length - 1;
            switch (yystate) {
                case 1:
                    return $$[$0 - 1];
                    break;
                case 2:
                    this.$ = "lt";
                    break;
                case 3:
                    this.$ = "lte";
                    break;
                case 4:
                    this.$ = "gt";
                    break;
                case 5:
                    this.$ = "gte";
                    break;
                case 6:
                    this.$ = "eq";
                    break;
                case 7:
                    this.$ = "ne";
                    break;
                case 12:
                    this.$ = { bool: { filter: [$$[$0 - 2], $$[$0]] } };
                    break;
                case 13:
                    this.$ = { bool: { should: [$$[$0 - 2], $$[$0]] } };
                    break;
                case 14:
                    this.$ = { bool: { must_not: $$[$0] } };
                    break;
                case 15:
                    this.$ = -$$[$0];
                    break;
                case 16:
                    this.$ = $$[$0 - 1];
                    break;
                case 17:
                    this.$ = formatExists(yy, $$[$0 - 2], "eq");
                    break;
                case 18:
                    this.$ = formatExists(yy, $$[$0 - 2], "ne");
                    break;
                case 19:
                    this.$ = formatQuery(yy, $$[$0 - 2], $$[$0 - 1], $$[$0]);
                    break;
            }
        },
        table: [
            { 3: 1, 4: 2, 14: $V0, 20: $V1, 21: $V2, 22: $V3 },
            { 1: [3] },
            { 5: [1, 7], 18: $V4, 19: $V5 },
            { 4: 10, 14: $V0, 20: $V1, 21: $V2, 22: $V3 },
            { 4: 11, 14: $V0, 20: $V1, 21: $V2, 22: $V3 },
            { 4: 12, 14: $V0, 20: $V1, 21: $V2, 22: $V3 },
            {
                6: 15,
                7: [1, 16],
                8: [1, 17],
                9: [1, 18],
                10: [1, 19],
                11: [1, 13],
                12: [1, 14],
            },
            { 1: [2, 1] },
            { 4: 20, 14: $V0, 20: $V1, 21: $V2, 22: $V3 },
            { 4: 21, 14: $V0, 20: $V1, 21: $V2, 22: $V3 },
            o($V6, [2, 14]),
            o($V6, [2, 15]),
            { 18: $V4, 19: $V5, 23: [1, 22] },
            o($V7, [2, 6], { 24: [1, 23] }),
            o($V7, [2, 7], { 24: [1, 24] }),
            { 13: 25, 14: [1, 26], 15: [1, 27], 16: [1, 28], 17: [1, 29] },
            o($V7, [2, 2]),
            o($V7, [2, 3]),
            o($V7, [2, 4]),
            o($V7, [2, 5]),
            o($V6, [2, 12]),
            o([5, 19, 23], [2, 13], { 18: $V4 }),
            o($V6, [2, 16]),
            o($V6, [2, 17]),
            o($V6, [2, 18]),
            o($V6, [2, 19]),
            o($V6, [2, 8]),
            o($V6, [2, 9]),
            o($V6, [2, 10]),
            o($V6, [2, 11]),
        ],
        defaultActions: { 7: [2, 1] },
        parseError: function parseError(str, hash) {
            if (hash.recoverable) {
                this.trace(str);
            } else {
                var error = new Error(str);
                error.hash = hash;
                throw error;
            }
        },
        parse: function parse(input) {
            var self = this,
                stack = [0],
                vstack = [null],
                lstack = [],
                table = this.table,
                yytext = "",
                yylineno = 0,
                yyleng = 0,
                recovering = 0,
                TERROR = 2,
                EOF = 1;
            var args = lstack.slice.call(arguments, 1);
            var lexer = Object.create(this.lexer);
            var sharedState = { yy: {} };
            for (var k in this.yy) {
                if (Object.prototype.hasOwnProperty.call(this.yy, k)) {
                    sharedState.yy[k] = this.yy[k];
                }
            }
            lexer.setInput(input, sharedState.yy);
            sharedState.yy.lexer = lexer;
            sharedState.yy.parser = this;
            if (typeof lexer.yylloc == "undefined") {
                lexer.yylloc = {};
            }
            yyloc = lexer.yylloc;
            lstack.push(yyloc);
            const ranges = lexer.options && lexer.options.ranges;
            if (typeof sharedState.yy.parseError === "function") {
                this.parseError = sharedState.yy.parseError;
            } else {
                this.parseError = Object.getPrototypeOf(this).parseError;
            }

            // _token_stack:
            function lex1() {
                token=undefined;
                token = lexer.lex() || EOF;
                if (typeof token !== 'number') {
                    token = self.symbols_[token] || token;
                }
                return token;
            }


             symbol=undefined;
                preErrorSymbol=undefined;
                state=undefined;
                action=undefined;
                a=undefined;
                r=undefined;
                yyval = {};
                p=undefined;
                len=undefined;
                newState=undefined;
                expected=undefined;
            while (true) {
                state = stack[stack.length - 1];
                if (this.defaultActions[state]) {
                    action = this.defaultActions[state];
                } else {
                    if (symbol === null || typeof symbol == "undefined") {
                        symbol = lex1();
                    }
                    action = table[state] && table[state][symbol];
                }
                if (typeof action === "undefined" || !action.length || !action[0]) {
                    var errStr = "";
                    expected = [];
                    for (p in table[state]) {
                        if (this.terminals_[p] && p > TERROR) {
                            expected.push("'" + this.terminals_[p] + "'");
                        }
                    }
                    if (lexer.showPosition) {
                        errStr =
                            "Parse error on line " +
                            (yylineno + 1) +
                            ":\n" +
                            lexer.showPosition() +
                            "\nExpecting " +
                            expected.join(", ") +
                            ", got '" +
                            (this.terminals_[symbol] || symbol) +
                            "'";
                    } else {
                        errStr =
                            "Parse error on line " +
                            (yylineno + 1) +
                            ": Unexpected " +
                            (symbol == EOF
                                ? "end of input"
                                : "'" + (this.terminals_[symbol] || symbol) + "'");
                    }
                    this.parseError(errStr, {
                        text: lexer.match,
                        token: this.terminals_[symbol] || symbol,
                        line: lexer.yylineno,
                        loc: yyloc,
                        expected: expected,
                    });
                }
                if (action[0] instanceof Array && action.length > 1) {
                    throw new Error(
                        "Parse Error: multiple actions possible at state: " +
                        state +
                        ", token: " +
                        symbol
                    );
                }
                switch (action[0]) {
                    case 1:
                        stack.push(symbol);
                        vstack.push(lexer.yytext);
                        lstack.push(lexer.yylloc);
                        stack.push(action[1]);
                        symbol = null;
                        if (!preErrorSymbol) {
                            yyleng = lexer.yyleng;
                            yytext = lexer.yytext;
                            yylineno = lexer.yylineno;
                            yyloc = lexer.yylloc;
                            if (recovering > 0) {
                                recovering--;
                            }
                        } else {
                            symbol = preErrorSymbol;
                            preErrorSymbol = null;
                        }
                        break;
                    case 2:
                        len = this.productions_[action[1]][1];
                        yyval.$ = vstack[vstack.length - len];
                        yyval._$ = {
                            first_line: lstack[lstack.length - (len || 1)].first_line,
                            last_line: lstack[lstack.length - 1].last_line,
                            first_column: lstack[lstack.length - (len || 1)].first_column,
                            last_column: lstack[lstack.length - 1].last_column,
                        };
                        if (ranges) {
                            yyval._$.range = [
                                lstack[lstack.length - (len || 1)].range[0],
                                lstack[lstack.length - 1].range[1],
                            ];
                        }
                        r = this.performAction.apply(
                            yyval,
                            [
                                yytext,
                                yyleng,
                                yylineno,
                                sharedState.yy,
                                action[1],
                                vstack,
                                lstack,
                            ].concat(args)
                        );
                        if (typeof r !== "undefined") {
                            return r;
                        }
                        if (len) {
                            stack = stack.slice(0, -1 * len * 2);
                            vstack = vstack.slice(0, -1 * len);
                            lstack = lstack.slice(0, -1 * len);
                        }
                        stack.push(this.productions_[action[1]][0]);
                        vstack.push(yyval.$);
                        lstack.push(yyval._$);
                        newState = table[stack[stack.length - 2]][stack[stack.length - 1]];
                        stack.push(newState);
                        break;
                    case 3:
                        return true;
                }
            }
            return true;
        },
    };
    function formatUnixTimestamp(value) {
        const date = new Date(value * 1000);
        return date.toLocaleString("en-US", {
            year: "numeric",
            month: "2-digit",
            day: "2-digit",
            hour: "2-digit",
            minute: "2-digit",
            second: "2-digit",
            hour12: false,
        });
    }
    function getFieldInfo(yy, field) {
        info = null;
        if (field.startsWith("db:")) {
            const dbField = field.substring(3);
            if (yy.dbFieldsMap[dbField]) {
                info = yy.dbFieldsMap[dbField];
            }
        } else if (yy.fieldsMap[field]) {
            info = yy.fieldsMap[field];
        }
        return info;
    }
    function getIpInfoList(yy, needPort) {
        const ors = [];
        const completed = {};
        for (field in yy.fieldsMap) {
            const info = yy.fieldsMap[field];
            if (field === "ip" || info.type !== "ip") {
                continue;
            }
            if (completed[info.dbField]) {
                continue;
            }
            completed[info.dbField] = 1;
            if (needPort && !info.portField) {
                continue;
            }
            if (info.requiredRight && yy[info.requiredRight] !== true) {
                continue;
            }
            ors.push(info);
        }
        return ors.sort(function (a, b){
            return a.exp.localeCompare(b.exp);
        });
    }
    function getRegexInfoList(yy, info) {
        const regex = new RegExp(info.regex);
        const ors = [];
        const completed = [];
        for ( f in yy.fieldsMap) {
            if (f.match(regex) && !completed[yy.fieldsMap[f].dbField]) {
                if (
                    yy.fieldsMap[f].requiredRight &&
                    yy[yy.fieldsMap[f].requiredRight] !== true
                ) {
                    continue;
                }
                ors.push(yy.fieldsMap[f]);
                completed[yy.fieldsMap[f].dbField] = 1;
            }
        }

        return ors.sort(function (a, b){ return a.exp.localeCompare(b.exp);});
    }

    function parseIpPort(yy, field, ipPortStr) {
        const dbField = getFieldInfo(yy, field).dbField;
        // Have just a single Ip, create obj for it
        function parseSingleIp(exp, singleDbField, singleIp, singlePort) {
            singleObj=undefined;
            if (typeof singlePort === "string" && singlePort.match(/[^0-9]/)) {
                throw singlePort + " not a valid singlePort";
            }
            if (singleIp !== undefined) {
                const colon = singleIp.indexOf(":");
                if (
                    (colon === -1 && singleIp.match(/[^.0-9/]/)) || // IP4
                    (colon !== -1 && singleIp.match(/[^a-fA-F:0-9/]/)) || // IP6
                    singleIp.match(/\/.*[^0-9]/)
                ) {
                    // CIDR
                    throw singleIp + " not a valid ip";
                }
                singleObj = { term: {} };
                singleObj.term[singleDbField] = singleIp;
            }
            if (singlePort !== -1) {
                const expInfo = getFieldInfo(yy, exp);
                if (expInfo.portField) {
                    singleObj = { bool: { filter: [singleObj, { term: {} }] } };
                    singleObj.bool.filter[1].term[expInfo.portField] = singlePort;
                } else {
                    throw exp + " doesn't support port";
                }
                if (singleIp === undefined) {
                    singleObj = singleObj.bool.filter[1];
                }
            }
            return singleObj;
        }
        // Special case of ip=
        function parseAllIp(allIp, allPort) {
            const infos = getIpInfoList(yy, allPort !== -1);
            const ors = [];
            for ( info in infos) {
                const allObj = parseSingleIp(info.exp, info.dbField, allIp, allPort);
                if (allObj) {
                    ors.push(allObj);
                }
            }
            return { bool: { should: ors } };
        }
        obj=undefined;
        ipPortStr = ipPortStr.trim();
        if (isArrayFull(ipPortStr)) {
            const list = ListToArrayMap(ipPortStr, function (str) {
                return parseIpPort(yy, field, str);
            });
            if (list.length === 1) {
                return list[0];
            }
            if (isArrayAND(ipPortStr)) {
                obj = { bool: { filter: list } };
            } else {
                obj = { bool: { should: list } };
            }
            return obj;
        }

        // Support ':80' and '.80'
        if (
            (ipPortStr[0] === ":" && ipPortStr[0] !== ":") ||
            ipPortStr[0] === "."
        ) {
            if (dbField !== "ipall") {
                return parseSingleIp(field, dbField, undefined, +ipPortStr.slice(1));
            } else {
                return parseAllIp(undefined, +ipPortStr.slice(1));
            }
        }

        // Support ip4: '10.10.10.10' '10.10.10/16:80' '10.10.10:80' '10.10.10/16'
        // Support ip6: '1::2' '1::2/16.80' '1::2.80' '1::2/16'
        ip=undefined;
        port = -1;
        const colons = ipPortStr.split(":");

        if (ipPortStr.includes("::")) {
            // Double colon is ip6 with 0 filled
            // Everything after . is port
            const dots = ipPortStr.split(".");
            if (dots.length > 1 && dots[1] !== "") {
                port = dots[1];
            }
            // Everything before . is ip and slash
            ip = dots[0];
        } else if (colons.length > 2) {
            // More than 1 colon is ip6
            // Everything after . is port
            const dots = ipPortStr.split(".");
            if (dots.length > 1 && dots[1] !== "") {
                port = dots[1];
            }
            const slash = dots[0].split("/");
            const colons2 = slash[0].split(":");
            // If the last one is empty just pretend : isn't there, for auto complete
            if (colons2[colons2.length - 1] === "") {
                colons2.length--;
            }
            if (slash[1] === undefined) {
                console.log(
                    colons2.length,
                    colons2,
                    colons2.length,
                    16 * colons2.length
                );
                slash[1] = (16 * colons2.length).toString();
            }

            if (colons2.length < 8) {
                ip = colons2.join(":") + "::";
            } else {
                ip = colons2.join(":");
            }

            // Add the slash back to the ip
            if (slash[1] && slash[1] !== "128") {
                // ip = `${ip}/${slash[1]}`;
                ip = ip + "/" + slash[1];
            }
        } else {
            // everything after : is port
            if (colons.length > 1 && colons[1] !== "") {
                port = colons[1];
            }

            // Have to do extra because we allow shorthand for /8, /16, /24
            const slash = colons[0].split("/");
            const dots = slash[0].split(".");

            // If the last one is empty just pretend . isn't there, for auto complete
            if (dots[dots.length - 1] === "") {
                dots.length--;
            }

            switch (dots.length) {
                case 4:
                    // ip = `${dots[0]}.${dots[1]}.${dots[2]}.${dots[3]}`;
                    ip = dots[0] + "." + dots[1] + "." + dots[2] + "." + dots[3];
                    break;
                case 3:
                    // ip = `${dots[0]}.${dots[1]}.${dots[2]}.0`;
                    ip = dots[0] + "." + dots[1] + "." + dots[2] + ".0";
                    if (slash[1] === undefined) {
                        slash[1] = "24";
                    }
                    break;
                case 2:
                    // ip = `${dots[0]}.${dots[1]}.0.0`;
                    ip = dots[0] + "." + dots[1] + ".0.0";
                    if (slash[1] === undefined) {
                        slash[1] = "16";
                    }
                    break;
                case 1:
                    if (dots[0].length > 0) {
                        // ip = `${dots[0]}.0.0.0`;
                        ip = dots[0] + ".0.0.0";
                        if (slash[1] === undefined) {
                            slash[1] = "8";
                        }
                    }
                    break;
            }

            // Add the slash back to the ip
            if (slash[1] && slash[1] !== "32") {
                // ip = `${ip}/${slash[1]}`;
                ip = ip + "/" + slash[1];
            }
        }

        if (dbField !== "ipall") {
            return parseSingleIp(field, dbField, ip, port);
        } else {
            return parseAllIp(ip, port);
        }
    }

    function stripQuotes(str) {
        if (str[0] === '"') {
            str = str.substring(1, str.length - 1);
        }
        return str;
    }

    function formatExists(yy, field, op) {
        const info = getFieldInfo(yy, field);
        if (!info) {
            throw "Unknown field " + field;
        }

        if (info.requiredRight && yy[info.requiredRight] !== true) {
            throw field + " - permission denied";
        }

        if (info.regex) {
            const regex = new RegExp(info.regex);
            const obj = [];
            const completed = [];
            for ( f in yy.fieldsMap) {
                if (f.match(regex) && !completed[yy.fieldsMap[f].dbField]) {
                    if (
                        yy.fieldsMap[f].requiredRight &&
                        yy[yy.fieldsMap[f].requiredRight] !== true
                    ) {
                        continue;
                    }
                    obj.push(formatExists(yy, f, "eq"));
                    completed[yy.fieldsMap[f].dbField] = 1;
                }
            }
            if (op === "ne") {
                return { bool: { must_not: obj } };
            } else {
                return { bool: { should: obj } };
            }
        }

        if (op === "ne") {
            return {
                bool: { must_not: { exists: { field: field2Raw(yy, field) } } },
            };
        }

        return { exists: { field: field2Raw(yy, field) } };
    }

    function formatQuery(yy, field, op, value) {
        if (value[0] === "/" && value[value.length - 1] === "/") {
            checkRegex(value);
        }

        const info = getFieldInfo(yy, field);
        if (!info) {
            throw "Unknown field " + field;
        }

        if (info.requiredRight && yy[info.requiredRight] !== true) {
            throw field + " - permission denied";
        }

        const nonShortcuts = ListToArray(value, true);

        const shortcutsObj = formatShortcutsQuery(yy, field, op, value);
        if (nonShortcuts.length === 0) {
            return shortcutsObj;
        }

        const normalObj = formatNormalQuery(yy, field, op, value);
        if (!shortcutsObj) {
            return normalObj;
        }

        if (op === "eq") {
            return { bool: { should: [normalObj, shortcutsObj] } };
        } else {
            return { bool: { must_not: [normalObj, shortcutsObj] } };
        }
    }
    function formatShortcutsQuery(yy, field, op, value, shortcutParent) {
        const shortcuts = ListToArrayShortcuts(yy, value);
        if (shortcuts.length === 0) {
            return undefined;
        }
        if (isArrayAND(value)) {
            throw value + " - AND array not supported with shortcuts";
        }
        obj=undefined;
        const info = getFieldInfo(yy, field);
        if (op !== "eq" && op !== "ne") {
            throw "Shortcuts only support == and !=";
        }
        obj = { bool: {} };
        operation = "should";
        if (op === "ne") {
            operation = "must_not";
        }
        obj.bool[operation] = [];
        shortcuts.forEach(function (shortcut) {
            shortcut = value = shortcut.substr(1); /* remove $ */
            if (!yy.shortcuts || !yy.shortcuts[shortcut]) {
                throw shortcut + " - Shortcut not found";
            }
            shortcut = yy.shortcuts[shortcut];
            const type = info.type2 || info.type;
            const shortcutType = yy.shortcutTypeMap[type];

            if (!shortcutType) {
                throw "Unsupported field type: " + type;
            }

            if (!shortcut._source[shortcutType]) {
                throw "shortcut must be of type " + shortcutType;
            }
            const terms = {};
            switch (type) {
                case "ip":
                    if (field === "ip") {
                        const infos = getIpInfoList(yy, false);
                        for ( ipInfo in infos) {
                            const newObj = formatShortcutsQuery(
                                yy,
                                ipInfo.exp,
                                op,
                                "$" + value,
                                obj
                            );
                            if (newObj) {
                                obj.bool[operation].concat(newObj);
                            }
                        }
                    } else {
                        terms[info.dbField] = {
                            index: yy.prefix+"lookups",
                            id: shortcut._id,
                            path: "ip",
                        };
                        if (shortcutParent) {
                            obj = shortcutParent;
                        }
                        obj.bool[operation].push({ terms });
                    }
                    break;
                case "integer":
                    terms[info.dbField] = {
                        index: yy.prefix+"lookups",
                        id: shortcut._id,
                        path: "number",
                    };
                    obj.bool[operation].push({ terms });
                    break;
                case "lotermfield":
                case "lotextfield":
                case "termfield":
                case "textfield":
                case "uptermfield":
                case "uptextfield":
                    if (info.regex) {
                        const infos = getRegexInfoList(yy, info);
                        for ( i in infos) {
                            const terms = {};
                            terms[i.dbField] = {
                                index: yy.prefix+"lookups",
                                id: shortcut._id,
                                path: "string",
                            };
                            obj.bool[operation].push({ terms });
                        }
                    } else {
                        terms[info.dbField] = {
                            index: yy.prefix+"lookups",
                            id: shortcut._id,
                            path: "string",
                        };
                        obj.bool[operation].push({ terms });
                    }
                    break;
                default:
                    throw "Unsupported field type: " + type;
            }
        });

        if (obj !=null && obj.bool!=null&&obj.bool.should!=null&&obj.bool.should.length === 1) {
            obj = obj.bool.should[0];
        }

        return obj;
    }

    function formatNormalQuery(yy, field, op, value) {
        obj=undefined;
        const info = getFieldInfo(yy, field);

        if (info.regex) {
            const infos = getRegexInfoList(yy, info);
            obj = [];
            const completed = [];
            for ( i in infos) {
                obj.push(formatQuery(yy, i.exp, op === "ne" ? "eq" : op, value));
            }

            if (op === "ne") {
                return { bool: { must_not: obj } };
            } else {
                return { bool: { should: obj } };
            }
        }

        switch (info.type2 || info.type) {
            case "ip":
                if (value[0] === "/") {
                    throw value + " - Regex not supported for ip queries";
                }

                if (value.indexOf("*") !== -1) {
                    throw value + " - Wildcard not supported for ip queries";
                }

                if (value === "ipv4") {
                    value = "0.0.0.0/0";
                }
                if (value === "ipv6") {
                    value = "0.0.0.0/0";
                    if (op === "ne") {
                        op = "eq";
                    } else {
                        op = "ne";
                    }
                }

                if (op === "eq") {
                    return parseIpPort(yy, field, value);
                }
                if (op === "ne") {
                    return { bool: { must_not: parseIpPort(yy, field, value) } };
                }

                if (isArrayStart(value)) {
                    throw (
                        value + " - List queries not supported for gt/lt queries - " + value
                    );
                }

                obj = { range: {} };
                obj.range[info.dbField] = {};
                obj.range[info.dbField][op] = value;
                return obj;
            case "integer":
                if (value[0] === "/") {
                    throw value + " - Regex queries not supported for integer queries";
                }

                if (op === "eq" || op === "ne") {
                    obj = termOrTermsInt(info.dbField, value);
                    if (op === "ne") {
                        obj = { bool: { must_not: obj } };
                    }
                    return obj;
                }

                if (isArrayStart(value)) {
                    throw (
                        value + " - List queries not supported for gt/lt queries - " + value
                    );
                }

                obj = { range: {} };
                obj.range[info.dbField] = {};
                obj.range[info.dbField][op] = parseInt(value);
                return obj;
            case "float":
                if (value[0] === "/") {
                    throw value + " - Regex queries not supported for float queries";
                }

                if (op === "eq" || op === "ne") {
                    obj = termOrTermsFloat(info.dbField, value);
                    if (op === "ne") {
                        obj = { bool: { must_not: obj } };
                    }
                    return obj;
                }

                if (isArrayStart(value)) {
                    throw (
                        value + " - List queries not supported for gt/lt queries - " + value
                    );
                }

                obj = { range: {} };
                obj.range[info.dbField] = {};
                obj.range[info.dbField][op] = parseFloat(value);
                return obj;
            case "lotermfield":
            case "lotextfield":
                if (op === "eq") {
                    return stringQuery(yy, field, value.toLowerCase());
                }
                if (op === "ne") {
                    return {
                        bool: { must_not: stringQuery(yy, field, value.toLowerCase()) },
                    };
                }
                throw "Invalid operator '" + op + "' for " + field;
            case "termfield":
            case "textfield":
                if (op === "eq") {
                    return stringQuery(yy, field, value);
                }
                if (op === "ne") {
                    return { bool: { must_not: stringQuery(yy, field, value) } };
                }
                throw "Invalid operator '" + op + "' for " + field;
            case "uptermfield":
            case "uptextfield":
                if (op === "eq") {
                    return stringQuery(yy, field, value.toUpperCase());
                }
                if (op === "ne") {
                    return {
                        bool: { must_not: stringQuery(yy, field, value.toUpperCase()) },
                    };
                }
                throw "Invalid operator '" + op + "' for " + field;
            case "fileand":
                if (isArrayStart(value)) {
                    throw (
                        value + " - List queries not supported for file queries - " + value
                    );
                }

                if (op === "eq") {
                    return { fileand: stripQuotes(value) };
                }
                if (op === "ne") {
                    return { bool: { must_not: { fileand: stripQuotes(value) } } };
                }
                throw op + " - not supported for file queries";
            case "viewand":
                if (isArrayStart(value)) {
                    throw (
                        value + " - List queries not supported for view queries - " + value
                    );
                }

                value = stripQuotes(value);
                if (!yy.views || !yy.views[value]) {
                    throw value + " - View not found for user";
                }

                if (op === "eq") {
                    return exports.parse(yy.views[value].expression);
                }
                if (op === "ne") {
                    return {
                        bool: { must_not: exports.parse(yy.views[value].expression) },
                    };
                }
                throw op + " - not supported for view queries";
            case "seconds":
                if (value[0] === "/") {
                    throw value + " - Regex queries not supported for date queries";
                }

                if (op === "eq" || op === "ne") {
                    obj = termOrTermsSeconds(info.dbField, value);
                    if (op === "ne") {
                        obj = { bool: { must_not: obj } };
                    }
                    return obj;
                }

                if (isArrayStart(value)) {
                    throw (
                        value + " - List queries not supported for gt/lt queries - " + value
                    );
                }

                obj = { range: {} };
                obj.range[info.dbField] = {};
                obj.range[info.dbField][op] = parseSeconds(stripQuotes(value));
                return obj;
            case "date":
                if (value[0] === "/") {
                    throw value + " - Regex queries not supported for date queries";
                }

                if (op === "eq" || op === "ne") {
                    obj = termOrTermsDate(info.dbField, value);
                    if (op === "ne") {
                        obj = { bool: { must_not: obj } };
                    }
                    return obj;
                }

                if (isArrayStart(value)) {
                    throw (
                        value + " - List queries not supported for gt/lt queries - " + value
                    );
                }

                obj = { range: {} };
                obj.range[info.dbField] = {};
                obj.range[info.dbField][op] = formatUnixTimestamp(
                    parseSeconds(stripQuotes(value))
                );
                return obj;
            default:
                throw "Unknown field type: " + info.type;
        }
    }

    function checkRegex(str) {
        m=undefined;
        if ((m = str.match(/^\/(?:\\?.)*?\//)) && m[0].length !== str.length) {
            throw "Must back slash any forward slashes in regexp query - " + m[0];
        }
    }

    function field2Raw(yy, field) {
        const info = getFieldInfo(yy, field);
        const dbField = info.dbField;
        if (info.rawField) {
            return info.rawField;
        }

        if (dbField.indexOf(".snow", dbField.length - 5) === 0) {
            return dbField.substring(0, dbField.length - 5) + ".raw";
        }

        return dbField;
    }

    function stringQuery(yy, field, str) {
        const info = getFieldInfo(yy, field);
        dbField = info.dbField;
        obj=undefined;

        if (str[0] === "/" && str[str.length - 1] === "/") {
            checkRegex(str);

            str = str.substring(1, str.length - 1);
            if (info.transform) {
                str = global.arkime[info.transform](str).replace(/2e/g, ".");
            }
            dbField = field2Raw(yy, field);
            obj = { regexp: {} };
            obj.regexp[dbField] = str.replace(/\\(.)/g, "$1");
            return obj;
        }

        quoted = false;
        if (str[0] === '"' && str[str.length - 1] === '"') {
            str = str.substring(1, str.length - 1).replace(/\\(")/g, "$1");
            quoted = true;
        } else if (isArrayFull(str)) {
            const rawField = field2Raw(yy, field);
            const strs = ListToArrayMap(str, global.arkime[info.transform]);

            const items = [];
            terms = null;
            strs.forEach(function (astr) {
                item=undefined;

                if (
                    typeof astr === "string" &&
                    astr[0] === "/" &&
                    astr[astr.length - 1] === "/"
                ) {
                    checkRegex(astr);

                    item = { regexp: {} };
                    item.regexp[rawField] = astr.substring(1, astr.length - 1);
                    items.push(item);
                } else if (typeof astr === "string" && astr.indexOf("*") !== -1) {
                    if (astr === "*") {
                        throw "Please use 'EXISTS!' instead of a '*' in expression";
                    }

                    item = { wildcard: {} };
                    item.wildcard[rawField] = astr;
                    items.push(item);
                } else {
                    if (astr[0] === '"' && astr[astr.length - 1] === '"') {
                        astr = astr.substring(1, astr.length - 1).replace(/\\(.)/g, "$1");
                    }

                    if (info.type.match(/termfield/)) {
                        if (isArrayAND(str)) {
                            item = { term: {} };
                            item.term[dbField] = astr;
                            items.push(item);
                            return;
                        }

                        // Reuse same terms element for all terms query and add to items once
                        if (terms === null) {
                            terms = { terms: {} };
                            terms.terms[dbField] = [];
                            items.push(terms);
                        }
                        terms.terms[dbField].push(astr);
                    } else {
                        item = { match_phrase: {} };
                        item.match_phrase[dbField] = astr;
                        items.push(item);
                    }
                }
            }); // forEach

            if (items.length === 1) {
                obj = items[0];
            } else if (isArrayAND(str)) {
                obj = { bool: { filter: items } };
            } else {
                obj = { bool: { should: items } };
            }

            return obj;
        }

        if (info.transform) {
            str = global.arkime[info.transform](str);
        }

        if (!isNaN(str) && !quoted) {
            obj = { term: {} };
            obj.term[dbField] = str;
        } else if (typeof str === "string" && str.indexOf("*") !== -1) {
            if (str === "*") {
                throw "Please use 'EXISTS!' instead of a '*' in expression";
            }
            dbField = field2Raw(yy, field);
            obj = { wildcard: {} };
            obj.wildcard[dbField] = str;
        } else if (info.type.match(/textfield/)) {
            obj = { match_phrase: {} };
            obj.match_phrase[dbField] = str;
        } else if (info.type.match(/termfield/)) {
            obj = { term: {} };
            obj.term[dbField] = str;
        }
        return obj;
    }
    global = { arkime: {} };
    global.arkime.utf8ToHex = function (utf8) {
        hex = Buffer.from(stripQuotes(utf8)).toString("hex").toLowerCase();
        hex = hex.replace(/2a/g, "*");
        return hex;
    };

    global.arkime.dash2Colon = function (str) {
        return str.replace(/-/g, ":");
    };

    const protocols = {
        icmp: 1,
        igmp: 2,
        tcp: 6,
        udp: 17,
        gre: 47,
        esp: 50,
        icmp6: 58,
        icmpv6: 58,
        ospf: 89,
        pim: 103,
        sctp: 132,
    };

    global.arkime.ipProtocolLookup = function (text) {
        if (typeof text !== "string") {
            for (i = 0; i < text.length; i++) {
                if (!protocols[text[i]] && isNaN(text[i])) {
                    throw "Unknown protocol string " + text;
                }
                text[i] = protocols[text[i]] || +text[i];
            }
            return text;
        } else {
            if (!protocols[text] && isNaN(text)) {
                throw "Unknown protocol string " + text;
            }
            return protocols[text] || +text;
        }
    };

    // Remove the "http://", "https://", etc from http.uri queries
    global.arkime.removeProtocol = function (text) {
        if (text[0] === "/" && text[text.length - 1] === "/") {
            return text;
        }
        text = text.replace(/^[a-z]+:\/\//i, "");
        return text;
    };

    // Remove the "http://", "https://" and after the first slash, etc from host queries
    global.arkime.removeProtocolAndURI = function (text) {
        if (text[0] === "/" && text[text.length - 1] === "/") {
            return text;
        }
        text = text.replace(/^[a-z]+:\/\//i, "");
        text = text.replace(/\/.*/, "");
        return text;
    };

    function isArrayAND(value) {
        return value[0] === "]";
    }

    function isArrayStart(value) {
        return value[0] === "[" || value[0] === "]";
    }

    function isArrayFull(value) {
        if (value[0] === "[" && value[value.length - 1] === "]") {
            return true;
        }
        return value[0] === "]" && value[value.length - 1] === "[";
    }
    function ListToArray(text, always) {
        if (isArrayFull(text)) {
            text = text.substring(1, text.length - 1);
        } else if (!always) {
            return text;
        }

        // JS doesn't have negative look behind
        const strs = text
            .replace(/\\\\/g, "**BACKSLASH**")
            .replace(/\\,/g, "**COMMA**")
            .split(/\s*,\s*/)
            .filter(function(part) {
                return part.trim()[0] !== "$";
            });
        for (i = 0; i < strs.length; i++) {
            strs[i] = strs[i]
                .replace("**COMMA**", ",")
                .replace("**BACKSLASH**", "\\");
        }
        return strs;
    }

    function ListToArrayMap(text, mapCb, always) {
        list = ListToArray(text, always);
        if (!mapCb || !Array.isArray(list)) {
            return list;
        }
        return list.map(mapCb);
    }

    function ListToArrayShortcuts(yy, text) {
        if (isArrayFull(text)) {
            text = text.substring(1, text.length - 1);
        }

        // JS doesn't have negative look behind
        const strs = text
            .replace(/\\\\/g, "**BACKSLASH**")
            .replace(/\\,/g, "**COMMA**")
            .split(/\s*,\s*/)
            .filter(function (part) {return part.trim()[0] === "$"});
        const nstrs = [];
        for (i = 0; i < strs.length; i++) {
            const str = strs[i]
                .replace("**COMMA**", ",")
                .replace("**BACKSLASH**", "\\");

            if (str.match(/[*?]/)) {
                const re = new RegExp(
                    "^" + str.substring(1).replace(/\*/g, ".*").replace(/\?/g, ".") + "$"
                );
                Object.keys(yy.shortcuts).forEach(function (s)  {
                    if (s.match(re)) {
                        nstrs.push("$" + s);
                    }
                });
            } else {
                nstrs.push(str);
            }
        }

        return nstrs;
    }

    function termOrTermsInt(dbField, str) {
        obj = {};
        if (isArrayFull(str)) {
            if (isArrayAND(str)) {
                obj.bool = {
                    filter: ListToArray(str).map(function (x)  {
                        const o = { term: {} };
                        o.term[dbField] = parseInt(x);
                        return o;
                    }),
                };
                return obj;
            }
            obj = { terms: {} };
            obj.terms[dbField] = ListToArray(str).map(function (x) {
                return parseInt(x)
            });
        } else {
            str = stripQuotes(str);
            match=undefined;
            if ((match = str.match(/(-?\d+)-(-?\d+)/))) {
                obj = { range: {} };
                obj.range[dbField] = {
                    gte: parseInt(match[1]),
                    lte: parseInt(match[2]),
                };
                return obj;
            } else if (str.match(/[^\d]+/)) {
                throw str + " is not a number";
            }
            obj = { term: {} };
            obj.term[dbField] = parseInt(str);
        }
        return obj;
    }

    function termOrTermsFloat(dbField, str) {
        obj = {};
        if (isArrayFull(str)) {
            if (isArrayAND(str)) {
                obj.bool = {
                    filter: ListToArray(str).map(function (x)  {
                        const o = { term: {} };
                        o.term[dbField] = parseFloat(x);
                        return o;
                    }),
                };
                return obj;
            }

            obj = { terms: {} };
            obj.terms[dbField] = ListToArray(str).map(function (x) {return parseFloat(x)});
        } else {
            str = stripQuotes(str);
            match=undefined;
            if (str.match(/^-?\d+$/) || str.match(/^-?\d+\.\d+$/)) {
                // good non range
            } else if ((match = str.match(/(-?\d*\.?\d*)-(-?\d*\.?\d*)/))) {
                obj = { range: {} };
                obj.range[dbField] = {
                    gte: parseFloat(match[1]),
                    lte: parseFloat(match[2]),
                };
                return obj;
            } else if (!(str.match(/^-?\d+$/) || str.match(/^-?\d+\.\d+$/))) {
                throw str + " is not a float";
            }
            obj = { term: {} };
            obj.term[dbField] = parseFloat(str);
        }
        return obj;
    }

    function termOrTermsSeconds(dbField, str) {
        obj = {};
        if (isArrayFull(str)) {
            if (isArrayAND(str)) {
                obj.bool = {
                    filter: ListToArray(str).map(function (x)  {
                        const o = { term: {} };
                        o.term[dbField] = parseSeconds(x);
                        return o;
                    }),
                };
                return obj;
            }

            obj = { terms: {} };
            obj.terms[dbField] = ListToArray(str).map(function (x) {return parseSeconds(x)});
        } else {
            str = parseSeconds(stripQuotes(str));
            obj = { term: {} };
            obj.term[dbField] = str;
        }
        return obj;
    }

    // This uses weird gte/lte range of the same date because if you give a second
    // date, you want everything that happen from 0ms-1000ms, not just at 0ms
    function termOrTermsDate(dbField, str) {
        if (isArrayFull(str)) {
            const items = [];
            ListToArray(str).forEach(function (astr) {
                const d = formatUnixTimestamp(parseSeconds(stripQuotes(astr)));
                const r = { range: {} };
                r.range[dbField] = { gte: d, lte: d };
                items.push(r);
            });

            if (isArrayAND(str)) {
                return { bool: { filter: items } };
            } else {
                return { bool: { should: items } };
            }
        }

        const d = formatUnixTimestamp(parseSeconds(stripQuotes(str)));
        const obj = { range: {} };
        obj.range[dbField] = { gte: d, lte: d };
        return obj;
    }

    function str2format(str) {
        if (str.match(/^(s|sec|secs|second|seconds)$/)) {
            return "seconds";
        } else if (str.match(/^(m|min|mins|minute|minutes)$/)) {
            return "minutes";
        } else if (str.match(/^(h|hr|hrs|hour|hours)$/)) {
            return "hours";
        } else if (str.match(/^(d|day|days)$/)) {
            return "days";
        } else if (str.match(/^(w|week|weeks)\d*$/)) {
            return "weeks";
        } else if (str.match(/^(M|mon|mons|month|months)$/)) {
            return "months";
        } else if (str.match(/^(q|qtr|qtrs|quarter|quarters)$/)) {
            return "quarters";
        } else if (str.match(/^(y|yr|yrs|year|years)$/)) {
            return "years";
        }
        return undefined;
    }

    function parseSeconds(str) {
        m=undefined;
        n=undefined;
        if ((m = str.match(/^([+-])(\d*)([a-z]*)([@]*)([a-z0-9]*)/))) {
            const d = new Date();
            const format = str2format(m[3]);
            const snap = str2format(m[5]);

            if (m[2] === "") {
                m[2] = 1;
            }

            if (snap) {
                if (snap === "weeks") {
                    const startOfWeek = new Date(d.setDate(d.getDate() - d.getDay()));
                    d.setHours(0, 0, 0, 0); // 设置到当天的开始
                    d.setTime(startOfWeek.getTime());
                } else {
                    const start = new Date(d);
                    switch (snap) {
                        case "seconds":
                            start.setMilliseconds(0);
                            break;
                        case "minutes":
                            start.setSeconds(0, 0);
                            break;
                        case "hours":
                            start.setMinutes(0, 0, 0);
                            break;
                        case "days":
                            start.setHours(0, 0, 0, 0);
                            break;
                        case "months":
                            start.setDate(1);
                            start.setHours(0, 0, 0, 0);
                            break;
                        case "years":
                            start.setMonth(0, 1);
                            start.setHours(0, 0, 0, 0);
                            break;
                    }
                    d.setTime(start.getTime());
                }

                if ((n = m[5].match(/^(w|week|weeks)(\d+)$/))) {
                    d.setDate(d.getDate() + (parseInt(n[2], 10) - d.getDay()));
                }
            }

            const value = (m[1] === "-" ? -1 : 1) * parseInt(m[2], 10);
            switch (format) {
                case "seconds":
                    d.setSeconds(d.getSeconds() + value);
                    break;
                case "minutes":
                    d.setMinutes(d.getMinutes() + value);
                    break;
                case "hours":
                    d.setHours(d.getHours() + value);
                    break;
                case "days":
                    d.setDate(d.getDate() + value);
                    break;
                case "weeks":
                    d.setDate(d.getDate() + value * 7);
                    break;
                case "months":
                    d.setMonth(d.getMonth() + value);
                    break;
                case "years":
                    d.setFullYear(d.getFullYear() + value);
                    break;
            }

            return Math.floor(d.getTime() / 1000);
        }

        if ((m = str.match(/^@([a-z0-9]+)/))) {
            const d = new Date();
            const snap = str2format(m[1]);

            if (snap) {
                switch (snap) {
                    case "seconds":
                        d.setMilliseconds(0);
                        break;
                    case "minutes":
                        d.setSeconds(0, 0);
                        break;
                    case "hours":
                        d.setMinutes(0, 0, 0);
                        break;
                    case "days":
                        d.setHours(0, 0, 0, 0);
                        break;
                    case "weeks":
                        d.setDate(d.getDate() - d.getDay());
                        d.setHours(0, 0, 0, 0);
                        break;
                    case "months":
                        d.setDate(1);
                        d.setHours(0, 0, 0, 0);
                        break;
                    case "years":
                        d.setMonth(0, 1);
                        d.setHours(0, 0, 0, 0);
                        break;
                }

                if ((n = m[1].match(/^(w|week|weeks)(\d+)$/))) {
                    d.setDate(d.getDate() + (parseInt(n[2], 10) - d.getDay()));
                }
            }
            return Math.floor(d.getTime() / 1000);
        }

        const parsedDate = new Date(str);
        return Math.floor(parsedDate.getTime() / 1000);
    }
    /* generated by jison-lex 0.3.4 */
    parser.lexer = (function () {
        return {
            EOF: 1,
            parseError: function parseError(str, hash) {
                if (this.yy.parser) {
                    this.yy.parser.parseError(str, hash);
                } else {
                    throw new Error(str);
                }
            },

            // resets the lexer, sets new input
            setInput: function (input, yy) {
                this.yy = yy || this.yy || {};
                this._input = input;
                this._more = this._backtrack = this.done = false;
                this.yylineno = this.yyleng = 0;
                this.yytext = this.matched = this.match = "";
                this.conditionStack = ["INITIAL"];
                this.yylloc = {
                    first_line: 1,
                    first_column: 0,
                    last_line: 1,
                    last_column: 0,
                };
                if (this.options.ranges) {
                    this.yylloc.range = [0, 0];
                }
                this.offset = 0;
                return this;
            },

            pastInput: function () {
                var past = this.matched.substr(
                    0,
                    this.matched.length - this.match.length
                );
                return (
                    (past.length > 20 ? "..." : "") + past.substr(-20).replace(/\n/g, "")
                );
            },

            // displays upcoming input, i.e. for error messages
            upcomingInput: function () {
                var next = this.match;
                if (next.length < 20) {
                    next += this._input.substr(0, 20 - next.length);
                }
                return (next.substr(0, 20) + (next.length > 20 ? "..." : "")).replace(
                    /\n/g,
                    ""
                );
            },
            showPosition: function () {
                var pre = this.pastInput();
                var c = new Array(pre.length + 1).join("-");
                return pre + this.upcomingInput() + "\n" + c + "^";
            },
            test_match: function (match, indexed_rule) {
                var token, lines, backup;

                if (this.options.backtrack_lexer) {
                    // save context
                    backup = {
                        yylineno: this.yylineno,
                        yylloc: {
                            first_line: this.yylloc.first_line,
                            last_line: this.last_line,
                            first_column: this.yylloc.first_column,
                            last_column: this.yylloc.last_column
                        },
                        yytext: this.yytext,
                        match: this.match,
                        matches: this.matches,
                        matched: this.matched,
                        yyleng: this.yyleng,
                        offset: this.offset,
                        _more: this._more,
                        _input: this._input,
                        yy: this.yy,
                        conditionStack: this.conditionStack.slice(0),
                        done: this.done
                    };
                    if (this.options.ranges) {
                        backup.yylloc.range = this.yylloc.range.slice(0);
                    }
                }

                lines = match[0].match(/(?:\r\n?|\n).*/g);
                if (lines) {
                    this.yylineno += lines.length;
                }
                this.yylloc = {
                    first_line: this.yylloc.last_line,
                    last_line: this.yylineno + 1,
                    first_column: this.yylloc.last_column,
                    last_column: lines
                        ? lines[lines.length - 1].length -
                        lines[lines.length - 1].match(/\r?\n?/)[0].length
                        : this.yylloc.last_column + match[0].length,
                };
                this.yytext += match[0];
                this.match += match[0];
                this.matches = match;
                this.yyleng = this.yytext.length;
                if (this.options.ranges) {
                    this.yylloc.range = [this.offset, (this.offset += this.yyleng)];
                }
                this._more = false;
                this._backtrack = false;
                this._input = this._input.slice(match[0].length);
                this.matched += match[0];
                token = this.performAction.call(
                    this,
                    this.yy,
                    this,
                    indexed_rule,
                    this.conditionStack[this.conditionStack.length - 1]
                );
                if (this.done && this._input) {
                    this.done = false;
                }
                if (token) {
                    return token;
                } else if (this._backtrack) {
                    // recover context
                    for (var k in backup) {
                        this[k] = backup[k];
                    }
                    return false; // rule action called reject() implying the next rule should be tested instead.
                }
                return false;
            },
            next: function () {
                if (this.done) {
                    return this.EOF;
                }
                if (!this._input) {
                    this.done = true;
                }

                var token, match, tempMatch, index;
                if (!this._more) {
                    this.yytext = "";
                    this.match = "";
                }
                var rules = this._currentRules();
                for (var i = 0; i < rules.length; i++) {
                    tempMatch = this._input.match(this.rules[rules[i]]);
                    if (tempMatch && (!match || tempMatch[0].length > match[0].length)) {
                        match = tempMatch;
                        index = i;
                        if (this.options.backtrack_lexer) {
                            token = this.test_match(tempMatch, rules[i]);
                            if (token !== false) {
                                return token;
                            } else if (this._backtrack) {
                                match = false;
                                continue; // rule action called reject() implying a rule MISmatch.
                            } else {
                                // else: this is a lexer rule which consumes input without producing a token (e.g. whitespace)
                                return false;
                            }
                        } else if (!this.options.flex) {
                            break;
                        }
                    }
                }
                if (match) {
                    token = this.test_match(match, rules[index]);
                    if (token !== false) {
                        return token;
                    }
                    // else: this is a lexer rule which consumes input without producing a token (e.g. whitespace)
                    return false;
                }
                if (this._input === "") {
                    return this.EOF;
                } else {
                    return this.parseError(
                        "Lexical error on line " +
                        (this.yylineno + 1) +
                        ". Unrecognized text.\n" +
                        this.showPosition(),
                        {
                            text: "",
                            token: null,
                            line: this.yylineno,
                        }
                    );
                }
            },
            lex: function lex() {
                r = this.next();
                if (r) {
                    return r;
                } else {
                    return this.lex();
                }
            },
            _currentRules: function _currentRules() {
                if (
                    this.conditionStack.length &&
                    this.conditionStack[this.conditionStack.length - 1]
                ) {
                    return this.conditions[
                        this.conditionStack[this.conditionStack.length - 1]
                        ].rules;
                } else {
                    return this.conditions["INITIAL"].rules;
                }
            },
            options: {flex: true},
            performAction: function anonymous(
                yy,
                yy_,
                $avoiding_name_collisions,
                YY_START
            ) {
                switch ($avoiding_name_collisions) {
                    case 0:
                        break;
                    case 1:
                        return 15;
                    case 2:
                        return 16;
                    case 3:
                        return 14;
                    case 4:
                        return 17;
                    case 5:
                        return 17;
                    case 6:
                        return "EXISTS";
                    case 7:
                        return 8;
                    case 8:
                        return 7;
                    case 9:
                        return 10;
                    case 10:
                        return 9;
                    case 11:
                        return 12;
                    case 12:
                        return 11;
                    case 13:
                        return 11;
                    case 14:
                        return 19;
                    case 15:
                        return 19;
                    case 16:
                        return 18;
                    case 17:
                        return 18;
                    case 18:
                        return 22;
                    case 19:
                        return 23;
                    case 20:
                        return 20;
                    case 21:
                        return 5;
                    case 22:
                        return "INVALID";
                    case 23:
                        console.log(yy_.yytext);
                        break;
                }
            },
            rules: [
                /^(?:\s+)/,
                /^(?:"(?:\\?.)*?")/,
                /^(?:\/(?:\\?.)*?\/)/,
                /^(?:[-+a-zA-Z0-9_.@:*?/$]+)/,
                /^(?:\[[^\]\\]*(?:\\.[^\]\\]*)*\])/,
                /^(?:\][^\[\\]*(?:\\.[^\[\\]*)*\[)/,
                /^(?:EXISTS!)/,
                /^(?:<=)/,
                /^(?:<)/,
                /^(?:>=)/,
                /^(?:>)/,
                /^(?:!=)/,
                /^(?:==)/,
                /^(?:=)/,
                /^(?:\|\|)/,
                /^(?:\|)/,
                /^(?:&&)/,
                /^(?:&)/,
                /^(?:\()/,
                /^(?:\))/,
                /^(?:!)/,
                /^(?:$)/,
                /^(?:.)/,
                /^(?:.)/,
            ],
            conditions: {
                INITIAL: {
                    rules: [
                        0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18,
                        19, 20, 21, 22, 23,
                    ],
                    inclusive: true,
                },
            },
        };
    })();
    return parser;
})();
function parse_exp(e) {
    return JSON.stringify(arkimeparser.parse(e));
}