What am I missing here? here is the log entry and my very simple decoder just to start and it fails:
Oct 31 11:22:05 127.0.0.1 W 5219816637.934 elo_581 213.126.45.119 GET / L/2284/58299/7d/origin-www.freeport.org.adns.net/night.jpg 200 188362153 1 097903 0 ASP/JSP%20source%20code%20leakage LEAKAGE/ SOURCE_CODE - RESPONSE_BODY <decoder name="WAF1"> <prematch>^\d\d\d \d\d \d\d:\d\d:\d\d \w+ LEAKAGE/SOURCE_CODE</ prematch> </decoder>
