Scratchy

Apache uses "-" for missing value.

parse.py combined_format_re assumes that the
second and third field will be missing (it looks for
"-(?P<unknown>.*?)-"

The second and third fields are for user id; in our log
files, the third field is filled in for most webDAV
requests, as these require authorization.

_testa='0.0.0.0 - first.m.last@example.com [19/Apr/
2002:12:22:02 -0400] "MKCOL / HTTP/1.1" 200 0'

# Yes, we had entries with spaces in them.
_testb='0.0.0.0 - first last [19/Apr/2002:12:22:02 -
0400] "DELETE / HTTP/1.1" 200 0'

# We even had a few that were entered as "",
# though I hope that was a config mistake.
I ended up using this regex for the user field:
'(?P<user2>(-)|([a-zA-Z0-9.@ _-]+)|"")'

It is possible that other characters would also appear,
but didn't happen to in our logs.