General information about fields mapping is here.

Code types

You provide peices of C# code that convert input regexp captures to parts of logical log messages. Fields mapping code can use any valid C# contructs to do the conversion. In the scope of the code there exist variables named as captures you specified in your head and body regexps. These variables have type StringSlice. Use helper functions to work with the variables. Do captureName.ToString() to get standard .Net System.String object for the capture. Try to make do with without conversion to System.String as this conversion is inefficient.

The code can be of two types: Expression or Function Body.

Expresion is like a formula that combines input captures. Examples of expressions

Expression Description
thread Simply returns "thread" capture as is.
TRIM(thread) Returns "thread" capture with leading and trailing spaces removed.
TO_DATETIME(time, "yyyy-MM-dd HH:mm:ss") Takes the capture named "time" and passes it to function TO_DATETIME for parsing.
logicalThread.Length > 0 ? logicalThread : threadId Ternary operator expression that selects one of two captures.

Function Body is more powerful. It can contain whatever you could put to a C# function: switch contructs, loops, try/catch, etc. Examples:

Function body Description
switch (level)
{
case "WARN": return Severity.Warning;
case "ERROR": 
case "FATAL": return Severity.Error;
default: return Severity.Info;
}
Maps value of capture "level" to log message severity. It's a function body for field Severity.