From 731eeed1c2d023fe6ba3382cfacd73e0c3b0e738 Mon Sep 17 00:00:00 2001
From: Joren <jorensc@riseup.net>
Date: Thu, 6 Mar 2025 10:43:32 +0100
Subject: [PATCH] Change to srcip so the geolocation works

---
 decoder.xml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/decoder.xml b/decoder.xml
index 6757cd0..81a4308 100644
--- a/decoder.xml
+++ b/decoder.xml
@@ -27,13 +27,13 @@
 <decoder name="cgfw-firewall-activity-fields">
   <parent>cgfw-firewall-activity</parent>
   <regex type="pcre2">srcIP=([\d\.]+)</regex>
-  <order>SourceIP</order>
+  <order>srcip</order>
 </decoder>
 
 <decoder name="cgfw-firewall-activity-fields">
   <parent>cgfw-firewall-activity</parent>
   <regex type="pcre2">srcPort=([\d\s]+)</regex>
-  <order>SourcePort</order>
+  <order>srcport</order>
 </decoder>
 
 <decoder name="cgfw-firewall-activity-fields">
@@ -45,13 +45,13 @@
 <decoder name="cgfw-firewall-activity-fields">
   <parent>cgfw-firewall-activity</parent>
   <regex type="pcre2">dstIP=([\d\.]+)</regex>
-  <order>DestinationIP</order>
+  <order>dstip</order>
 </decoder>
 
 <decoder name="cgfw-firewall-activity-fields">
   <parent>cgfw-firewall-activity</parent>
   <regex type="pcre2">dstPort=([\w\s]+)</regex>
-  <order>DestinationPort</order>
+  <order>dstport</order>
 </decoder>
 
 <decoder name="cgfw-firewall-activity-fields">