<xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
  <xs:element name="TimberWinR">
    <xs:complexType>
      <xs:sequence>
        <xs:element name="Inputs">
          <xs:complexType>
            <xs:sequence minOccurs="0" maxOccurs="unbounded">
              <xs:choice>
              <xs:element name="WindowsEvents" minOccurs="0">
                <xs:complexType>
                  <xs:sequence>
                    <xs:element name="Event" maxOccurs="unbounded" minOccurs="0">
                      <xs:complexType mixed="true">
                        <xs:sequence>
                          <xs:element name="Fields" minOccurs="0">
                            <xs:complexType>
                              <xs:sequence>
                                <xs:element name="Field" maxOccurs="unbounded" minOccurs="0">
                                  <xs:complexType>
                                    <xs:simpleContent>
                                      <xs:extension base="xs:string">
                                        <xs:attribute name="name" use="required">
                                          <xs:simpleType>
                                            <xs:restriction base="xs:string">
                                              <xs:pattern value="EventLog|RecordNumber|TimeGenerated|TimeWritten|EventID|EventType|EventTypeName|EventCategory|EventCategoryName|SourceName|Strings|ComputerName|SID|Message|Data" />
                                            </xs:restriction>
                                          </xs:simpleType>
                                        </xs:attribute>
                                      </xs:extension>
                                    </xs:simpleContent>
                                  </xs:complexType>
                                </xs:element>
                              </xs:sequence>
                            </xs:complexType>
                          </xs:element>
                        </xs:sequence>
                        <xs:attribute type="xs:string" name="source" use="required"/>
                        <xs:attribute name="fullText" use="optional">
                          <xs:simpleType>
                            <xs:restriction base="xs:string">
                              <xs:pattern value="ON|on|OFF|off|true|false" />
                            </xs:restriction>
                          </xs:simpleType>
                        </xs:attribute>
                        <xs:attribute name="resolveSIDs" use="optional">
                          <xs:simpleType>
                            <xs:restriction base="xs:string">
                              <xs:pattern value="ON|on|OFF|off|true|false" />
                            </xs:restriction>
                          </xs:simpleType>
                        </xs:attribute>
                        <xs:attribute name="formatMsg" use="optional">
                          <xs:simpleType>
                            <xs:restriction base="xs:string">
                              <xs:pattern value="ON|on|OFF|off|true|false" />
                            </xs:restriction>
                          </xs:simpleType>
                        </xs:attribute>
                        <xs:attribute name="msgErrorMode" use="optional">
                          <xs:simpleType>
                            <xs:restriction base="xs:string">
                              <xs:pattern value="NULL|null|ERROR|error|MSG|msg" />
                            </xs:restriction>
                          </xs:simpleType>
                        </xs:attribute>
                        <xs:attribute name="fullEventCode" use="optional">
                          <xs:simpleType>
                            <xs:restriction base="xs:string">
                              <xs:pattern value="ON|on|OFF|off|true|false" />
                            </xs:restriction>
                          </xs:simpleType>
                        </xs:attribute>
                        <xs:attribute name="direction" use="optional">
                          <xs:simpleType>
                            <xs:restriction base="xs:string">
                              <xs:pattern value="FW|fw|BW|bw" />
                            </xs:restriction>
                          </xs:simpleType>
                        </xs:attribute>
                        <xs:attribute type="xs:string" name="stringsSep" use="optional"/>
                        <xs:attribute type="xs:string" name="iCheckpoint" use="optional"/>
                        <xs:attribute name="binaryFormat" use="optional">
                          <xs:simpleType>
                            <xs:restriction base="xs:string">
                              <xs:pattern value="ASC|asc|PRINT|print|HEX|hex" />
                            </xs:restriction>
                          </xs:simpleType>
                        </xs:attribute>
                      </xs:complexType>
                    </xs:element>
                  </xs:sequence>
                </xs:complexType>
              </xs:element>
              <xs:element name="Logs" minOccurs="0">
                <xs:complexType>
                  <xs:sequence>
                    <xs:element name="Log" maxOccurs="unbounded" minOccurs="0">
                      <xs:complexType mixed="true">
                        <xs:sequence>
                          <xs:element name="Fields" minOccurs="0">
                            <xs:complexType>
                              <xs:sequence>
                                <xs:element name="Field" maxOccurs="unbounded" minOccurs="0">
                                  <xs:complexType>
                                    <xs:simpleContent>
                                      <xs:extension base="xs:string">
                                        <xs:attribute name="name" use="required">
                                          <xs:simpleType>
                                            <xs:restriction base="xs:string">
                                              <xs:pattern value="LogFilename|Index|Text" />
                                            </xs:restriction>
                                          </xs:simpleType>
                                        </xs:attribute>
                                      </xs:extension>
                                    </xs:simpleContent>
                                  </xs:complexType>
                                </xs:element>
                              </xs:sequence>
                            </xs:complexType>
                          </xs:element>
                        </xs:sequence>
                        <xs:attribute type="xs:string" name="name" use="required"/>
                        <xs:attribute type="xs:string" name="location" use="required"/>
                        <xs:attribute type="xs:int" name="iCodepage" use="optional"/>
                        <xs:attribute type="xs:int" name="recurse" use="optional"/>
                        <xs:attribute name="splitLongLines" use="optional">
                          <xs:simpleType>
                            <xs:restriction base="xs:string">
                              <xs:pattern value="ON|on|OFF|off|true|false" />
                            </xs:restriction>
                          </xs:simpleType>
                        </xs:attribute>
                        <xs:attribute type="xs:string" name="iCheckpoint" use="optional"/>
                      </xs:complexType>
                    </xs:element>
                  </xs:sequence>
                </xs:complexType>
              </xs:element>
              <xs:element name="IISLogs" minOccurs="0">
                <xs:complexType>
                  <xs:sequence>
                    <xs:element name="IISLog" maxOccurs="unbounded" minOccurs="0">
                      <xs:complexType mixed="true">
                        <xs:sequence>
                          <xs:element name="Fields" minOccurs="0">
                            <xs:complexType>
                              <xs:sequence>
                                <xs:element name="Field" maxOccurs="unbounded" minOccurs="0">
                                  <xs:complexType>
                                    <xs:simpleContent>
                                      <xs:extension base="xs:string">
                                        <xs:attribute name="name" use="required">
                                          <xs:simpleType>
                                            <xs:restriction base="xs:string">
                                              <xs:pattern value="LogFilename|LogRow|UserIP|UserName|Date|Time|ServiceInstance|HostName|ServerIP|TimeTaken|BytesSent|BytesReceived|StatusCode|Win32StatusCode|RequestType|Target|Parameters" />
                                            </xs:restriction>
                                          </xs:simpleType>
                                        </xs:attribute>
                                      </xs:extension>
                                    </xs:simpleContent>
                                  </xs:complexType>
                                </xs:element>
                              </xs:sequence>
                            </xs:complexType>
                          </xs:element>
                        </xs:sequence>
                        <xs:attribute type="xs:string" name="name" use="required"/>
                        <xs:attribute type="xs:string" name="location" use="required"/>
                        <xs:attribute type="xs:int" name="iCodepage" use="optional"/>
                        <xs:attribute type="xs:int" name="recurse" use="optional"/>
                        <xs:attribute name="minDateMod" use="optional">
                          <xs:simpleType>
                            <xs:restriction base="xs:token">
                              <xs:pattern value="[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}" />
                            </xs:restriction>
                          </xs:simpleType>
                        </xs:attribute>
                        <xs:attribute type="xs:string" name="locale" use="optional"/>
                        <xs:attribute type="xs:string" name="iCheckpoint" use="optional"/>
                      </xs:complexType>
                    </xs:element>
                  </xs:sequence>
                </xs:complexType>
              </xs:element>
              <xs:element name="IISW3CLogs" minOccurs="0">
                <xs:complexType>
                  <xs:sequence>
                    <xs:element name="IISW3CLog" maxOccurs="unbounded" minOccurs="0">
                      <xs:complexType mixed="true">
                        <xs:sequence>
                          <xs:element name="Fields" minOccurs="0">
                            <xs:complexType>
                              <xs:sequence>
                                <xs:element name="Field" maxOccurs="unbounded" minOccurs="0">
                                  <xs:complexType>
                                    <xs:simpleContent>
                                      <xs:extension base="xs:string">
                                        <xs:attribute name="name" use="required">
                                          <xs:simpleType>
                                            <xs:restriction base="xs:string">
                                              <xs:pattern value="LogFilename|LogRow|date|time|c-ip|cs-username|s-sitename|s-computername|s-ip|s-port|cs-method|cs-uri-stem|cs-uri-query|sc-status|sc-substatus|sc-win32-status|sc-bytes|cs-bytes|time-taken|cs-version|cs-host|cs(User-Agent)|cs(Cookie)|cs(Referer)|s-event|s-process-type|s-user-time|s-kernel-time|s-page-faults|s-total-procs|s-active-procs|s-stopped-procs" />
                                            </xs:restriction>
                                          </xs:simpleType>
                                        </xs:attribute>
                                      </xs:extension>
                                    </xs:simpleContent>
                                  </xs:complexType>
                                </xs:element>
                              </xs:sequence>
                            </xs:complexType>
                          </xs:element>
                        </xs:sequence>
                        <xs:attribute type="xs:string" name="name" use="required"/>
                        <xs:attribute type="xs:string" name="location" use="required"/>
                        <xs:attribute type="xs:int" name="iCodepage" use="optional"/>
                        <xs:attribute type="xs:int" name="recurse" use="optional"/>
                        <xs:attribute name="minDateMod" use="optional">
                          <xs:simpleType>
                            <xs:restriction base="xs:token">
                              <xs:pattern value="[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}" />
                            </xs:restriction>
                          </xs:simpleType>
                        </xs:attribute>
                        <xs:attribute name="dQuotes" use="optional">
                          <xs:simpleType>
                            <xs:restriction base="xs:string">
                              <xs:pattern value="ON|on|OFF|off|true|false" />
                            </xs:restriction>
                          </xs:simpleType>
                        </xs:attribute>
                        <xs:attribute name="dirTime" use="optional">
                          <xs:simpleType>
                            <xs:restriction base="xs:string">
                              <xs:pattern value="ON|on|OFF|off|true|false" />
                            </xs:restriction>
                          </xs:simpleType>
                        </xs:attribute>
                        <xs:attribute name="consolidateLogs" use="optional">
                          <xs:simpleType>
                            <xs:restriction base="xs:string">
                              <xs:pattern value="ON|on|OFF|off|true|false" />
                            </xs:restriction>
                          </xs:simpleType>
                        </xs:attribute>
                        <xs:attribute type="xs:string" name="iCheckpoint" use="optional"/>
                      </xs:complexType>
                    </xs:element>
                  </xs:sequence>
                </xs:complexType>
              </xs:element>
              </xs:choice>
            </xs:sequence>
          </xs:complexType>
        </xs:element>
        <xs:element name="Filters" minOccurs="0">
          <xs:complexType>
            <xs:sequence minOccurs="0" maxOccurs="unbounded">
              <xs:choice>
                <xs:element name="Grok" minOccurs="0">
                  <xs:complexType>
                    <xs:sequence>
                      <xs:element name="Match" minOccurs="0">
                        <xs:complexType>
                          <xs:simpleContent>
                            <xs:extension base="xs:string">
                              <xs:attribute type="xs:string" name="field" use="required"/>
                              <xs:attribute type="xs:string" name="value" use="required"/>
                            </xs:extension>
                          </xs:simpleContent>
                        </xs:complexType>
                      </xs:element>
                      <xs:element name="AddField" minOccurs="0">
                        <xs:complexType>
                          <xs:simpleContent>
                            <xs:extension base="xs:string">
                              <xs:attribute type="xs:string" name="name" use="required"/>
                              <xs:attribute type="xs:string" name="value" use="required"/>
                            </xs:extension>
                          </xs:simpleContent>
                        </xs:complexType>
                      </xs:element>
                      <xs:element name="DropIfMatch" minOccurs="0">
                        <xs:complexType>
                          <xs:simpleContent>
                            <xs:extension base="xs:string">
                              <xs:attribute type="xs:string" name="value" use="required"/>
                            </xs:extension>
                          </xs:simpleContent>
                        </xs:complexType>
                      </xs:element>
                      <xs:element name="RemoveField" minOccurs="0">
                        <xs:complexType>
                          <xs:simpleContent>
                            <xs:extension base="xs:string">
                              <xs:attribute type="xs:string" name="value" use="required"/>
                            </xs:extension>
                          </xs:simpleContent>
                        </xs:complexType>
                      </xs:element>
                    </xs:sequence>
                  </xs:complexType>
                </xs:element>
                <xs:element name="Mutate">
                  <xs:complexType>
                    <xs:sequence>
                      <xs:choice>
                      <xs:element name="Rename" maxOccurs="unbounded" minOccurs="0">
                        <xs:complexType>
                          <xs:simpleContent>
                            <xs:extension base="xs:string">
                              <xs:attribute type="xs:string" name="oldName" use="optional"/>
                              <xs:attribute type="xs:string" name="newName" use="optional"/>
                            </xs:extension>
                          </xs:simpleContent>
                        </xs:complexType>
                      </xs:element>
                      <xs:element name="Remove" maxOccurs="unbounded" minOccurs="0">
                        <xs:complexType>
                          <xs:simpleContent>
                            <xs:extension base="xs:string">
                              <xs:attribute type="xs:string" name="field" use="optional"/>
                            </xs:extension>
                          </xs:simpleContent>
                        </xs:complexType>
                      </xs:element>
                      </xs:choice>
                    </xs:sequence>
                  </xs:complexType>
                </xs:element>
                <xs:element name="Date">
                  <xs:complexType>
                    <xs:sequence>
                      <xs:element type="xs:string" name="Pattern" maxOccurs="unbounded" minOccurs="0"/>
                    </xs:sequence>
                    <xs:attribute type="xs:string" name="field" use="required"/>
                    <xs:attribute type="xs:string" name="target" use="optional"/>
                    <xs:attribute type="xs:string" name="convertToUTC" use="optional"/>
                  </xs:complexType>
                </xs:element>
              </xs:choice>
            </xs:sequence>
          </xs:complexType>
        </xs:element>
      </xs:sequence>
    </xs:complexType>
  </xs:element>
</xs:schema>
