+ /* User is an alias to dstuser */
+ else if (!strcmp(word, "user")) {
+ pi->order[order_int] = DstUser_FP;
+ } else if (!strcmp(word, "srcip")) {
+ pi->order[order_int] = SrcIP_FP;
+ } else if (!strcmp(word, "dstip")) {
+ pi->order[order_int] = DstIP_FP;
+ } else if (!strcmp(word, "srcport")) {
+ pi->order[order_int] = SrcPort_FP;
+ } else if (!strcmp(word, "dstport")) {
+ pi->order[order_int] = DstPort_FP;
+ } else if (!strcmp(word, "protocol")) {
+ pi->order[order_int] = Protocol_FP;
+ } else if (!strcmp(word, "action")) {
+ pi->order[order_int] = Action_FP;
+ } else if (!strcmp(word, "id")) {
+ pi->order[order_int] = ID_FP;
+ } else if (!strcmp(word, "url")) {
+ pi->order[order_int] = Url_FP;
+ } else if (!strcmp(word, "data")) {
+ pi->order[order_int] = Data_FP;
+ } else if (!strcmp(word, "extra_data")) {
+ pi->order[order_int] = Data_FP;
+ } else if (!strcmp(word, "status")) {
+ pi->order[order_int] = Status_FP;
+ } else if (!strcmp(word, "system_name")) {
+ pi->order[order_int] = SystemName_FP;
+ } else if (strstr(*norder, "filename") != NULL) {
+ pi->order[order_int] = FileName_FP;
+ } else {
+ pi->order[order_int] = DynamicField_FP;
+ pi->fields[order_int] = strdup(*norder);
+