<ExportLogFormat>
    <start_message_body></start_message_body>
    <end_message_body></end_message_body>
    <message_separator>&#10;</message_separator> <!-- &#10;=='\n'  -->
    <fields_separatator>";</fields_separatator>
    <field_value_separatator>:"</field_value_separatator>
    <escape_chars>
            <char>
                <orig>=</orig>
                <escaped>\=</escaped>
            </char>
            <char>
                <orig>&#10;</orig>
                <escaped> </escaped>
            </char>
    </escape_chars>
     <!-- CEF Format header defintion  CEF:Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|Extension -->
    <FormatHeader>
    <header_format_replacment_string>{}</header_format_replacment_string>
    <!-- Log Header will be generated according this format string. Every "{}" will be replaced with header value -->
     <!-- <header_format>{}|{}|{}|{}|{}|{}|{}|</header_format> -->
     <header_format></header_format>
      <!-- See "assign_order" element  "join" mode explanation. The default separator to  joined value  is " "  -->
      <assign_order_join_separator> </assign_order_join_separator>
       <escape_chars>
            <char>
                <orig>\</orig><!--MUST be first to prevent double escaping -->
                <escaped>\\</escaped>
            </char>
            <char>
                <orig>|</orig>
                <escaped>\|</escaped>
            </char>
           <char>
               <orig>&#10;</orig>
               <escaped> AND </escaped>
           </char>
     </escape_chars>
     <headers>
    </headers>
    </FormatHeader>
</ExportLogFormat>