diff --git a/accesslog.go b/accesslog.go
deleted file mode 100644
index cd6b75e..0000000
--- a/accesslog.go
+++ /dev/null
@@ -1,163 +0,0 @@
-package main
-
-import (
-	"bufio"
-	"compress/gzip"
-	"github.com/mileusna/useragent"
-	"io"
-	"log"
-	"net/url"
-	"os"
-	"path/filepath"
-	"regexp"
-	"strconv"
-	"strings"
-	"time"
-)
-
-// TODO add support to nginx config syntax, eg "$remote_addr - $remote_user [$time_local] ..." and add code to translate it to these regexes
-// FIXME consolidate field list (duplicated knowledge)
-const LOG_COMBINED_PATTERN = `(?P<ip>\S+) - (?P<remote_user>\S+) \[(?P<time>.*?)\] "(?P<request_raw>[^"]*)" (?P<status>\d{3}) (?P<bytes_sent>\d+) "(?P<referer>[^"]*)" "(?P<user_agent_raw>[^"]*)"`
-
-var logPattern = regexp.MustCompile(LOG_COMBINED_PATTERN)
-
-// Parse the fields in the nginx access logs since the `until` time, passing them as a map into the `processFun`.
-// Processing is interrupted when a log older than `until` is found.
-func ProcessAccessLogs(logFiles []string, until *time.Time, processFun func(map[string]interface{}) error) error {
-	for _, path := range logFiles {
-
-		log.Printf("parsing %s", path)
-		file, err := os.Open(path)
-		if err != nil {
-			return err
-		}
-		defer file.Close()
-
-		// if it's gzipped, wrap in a decompressing reader
-		var reader io.Reader = file
-		if filepath.Ext(path) == ".gz" {
-			if reader, err = gzip.NewReader(file); err != nil {
-				return err
-			}
-		}
-
-		scanner := bufio.NewScanner(reader)
-		for scanner.Scan() {
-			line := scanner.Text()
-			values, err := parseLogLine(line)
-			if err != nil {
-				return err
-			}
-			if values == nil {
-				log.Printf("couldn't parse line %s", line)
-				continue
-			}
-
-			if until != nil && values["time"].(time.Time).Compare(*until) < 0 {
-				// already caught up, no need to continue processing
-				return nil
-			}
-
-			if err := processFun(values); err != nil {
-				return err
-			}
-		}
-		if err := scanner.Err(); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func parseLogLine(logLine string) (map[string]interface{}, error) {
-	match := logPattern.FindStringSubmatch(logLine)
-	if match == nil {
-		return nil, nil
-	}
-	result := make(map[string]interface{})
-	for i, name := range logPattern.SubexpNames() {
-		if i != 0 && name != "" && match[i] != "-" {
-			result[name] = match[i]
-		}
-	}
-
-	// assuming all the fields were found otherwise there would be no match above
-
-	// parse log time to time.Time
-	time, err := timeFromLogFormat(result["time"].(string))
-	if err != nil {
-		return nil, err
-	}
-	result["time"] = time
-
-	// bytes as integer
-	bytes_sent, _ := strconv.Atoi(result["bytes_sent"].(string))
-	result["bytes_sent"] = bytes_sent
-
-	// status as integer
-	status, _ := strconv.Atoi(result["status"].(string))
-	result["status"] = status
-
-	if ua, found := result["user_agent_raw"]; found {
-		ua := useragent.Parse(ua.(string))
-		result["user_agent"] = ua.Name
-		result["os"] = ua.OS
-		result["device"] = ua.Device
-		result["ua_url"] = stripUrlSource(ua.URL)
-		if ua.Bot {
-			result["ua_type"] = "bot"
-		} else if ua.Tablet {
-			result["ua_type"] = "tablet"
-		} else if ua.Mobile {
-			result["ua_type"] = "mobile"
-		} else if ua.Desktop {
-			result["ua_type"] = "desktop"
-		}
-	}
-
-	referer, hasReferer := result["referer"]
-	if hasReferer {
-		result["referer"] = stripUrlSource(referer.(string))
-	}
-
-	request_parts := strings.Split(result["request_raw"].(string), " ")
-	if len(request_parts) == 3 {
-		// if the request line is weird, don't try to extract its fields
-		result["method"] = request_parts[0]
-		raw_path := request_parts[1]
-		if url, err := url.Parse(raw_path); err == nil {
-			result["path"] = url.Path
-
-			// if utm source and friends in query, use them as referer
-			if !hasReferer {
-				keys := []string{"ref", "referer", "referrer", "utm_source"}
-				query := url.Query()
-				for _, key := range keys {
-					if query.Has(key) {
-						result["referer"] = stripUrlSource(query.Get(key))
-						break
-					}
-				}
-			}
-
-		} else {
-			result["path"] = raw_path
-		}
-	}
-
-	return result, nil
-}
-
-func stripUrlSource(value string) string {
-	value = strings.TrimPrefix(value, "http://")
-	value = strings.TrimPrefix(value, "https://")
-	value = strings.TrimPrefix(value, "www.")
-	value = strings.TrimSuffix(value, "/")
-	return value
-}
-
-func timeFromLogFormat(timestamp string) (time.Time, error) {
-	clfLayout := "02/Jan/2006:15:04:05 -0700"
-	return time.Parse(clfLayout, timestamp)
-}
diff --git a/db.go b/db.go
index 96145c5..c5c74f1 100644
--- a/db.go
+++ b/db.go
@@ -24,6 +24,8 @@ type dbSession struct {
 	insertStmt *sql.Stmt
 }
 
+const DB_DATE_LAYOUT = "2006-01-02 15:04:05-07:00"
+
 // Open or create the database at the given path.
 func InitDB(dbPath string) (*dbSession, error) {
 	db, err := sql.Open("sqlite3", dbPath)
@@ -36,17 +38,17 @@ func InitDB(dbPath string) (*dbSession, error) {
 	}
 
 	// TODO consider adding indexes according to expected queries
-
+	// FIXME build this dynamically based on the log format columns
 	sqlStmt := `
 		CREATE TABLE IF NOT EXISTS access_logs (
 			id 				INTEGER NOT NULL PRIMARY KEY,
+			created TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
 
 			ip				TEXT,
 			time 			TIMESTAMP NOT NULL,
 			request_raw		TEXT NOT NULL,
 			user_agent_raw 	TEXT,
 			status			INTEGER,
-			bytes_sent		INTEGER,
 			referer 		TEXT COLLATE NOCASE,
 
 			method			TEXT COLLATE NOCASE,
@@ -55,10 +57,8 @@ func InitDB(dbPath string) (*dbSession, error) {
 			os			 	TEXT COLLATE NOCASE,
 			device		 	TEXT COLLATE NOCASE,
 			ua_url		 	TEXT,
-			ua_type		 	TEXT COLLATE NOCASE,
-
+			ua_type		 	TEXT COLLATE NOCASE
 
-			created TIMESTAMP DEFAULT CURRENT_TIMESTAMP
 		);
 	`
 	_, err = db.Exec(sqlStmt)
@@ -86,7 +86,7 @@ func (dbs *dbSession) PrepareForUpdate(columns []string) (*time.Time, error) {
 			return nil, err
 		}
 
-		t, _ := timeFromDBFormat(lastSeenTimeStr)
+		t, _ := time.Parse(DB_DATE_LAYOUT, lastSeenTimeStr)
 		lastSeemTime = &t
 	}
 
@@ -217,8 +217,3 @@ func (spec *RequestCountSpec) buildQuery() (string, []any) {
 
 	return queryString, queryArgs
 }
-
-func timeFromDBFormat(timestamp string) (time.Time, error) {
-	sqliteLayout := "2006-01-02 15:04:05-07:00"
-	return time.Parse(sqliteLayout, timestamp)
-}
diff --git a/main.go b/main.go
index 3d7c922..6974772 100644
--- a/main.go
+++ b/main.go
@@ -24,29 +24,6 @@ type CommandArgs struct {
 	Where  []string `short:"w" optional:"" help:"Filter expressions. Example: -w useragent=Safari -w status=200"`
 }
 
-// FIXME consolidate field list (duplicated knowledge)
-var FIELD_NAMES = map[string]string{
-	"user_agent": "user_agent",
-	"useragent":  "user_agent",
-	"ua":         "user_agent",
-	"ua_type":    "ua_type",
-	"uatype":     "ua_type",
-	"ua_url":     "ua_url",
-	"uaurl":      "ua_url",
-	"os":         "os",
-	"device":     "device",
-	"request":    "request_raw",
-	"bytes":      "bytes_sent",
-	"bytes_sent": "bytes_sent",
-	"path":       "path",
-	"url":        "path",
-	"ip":         "ip",
-	"referer":    "referer",
-	"referrer":   "referer",
-	"status":     "status",
-	"method":     "method",
-}
-
 // Use a var to get current time, allowing for tests to override it
 var NowTimeFun = time.Now
 
@@ -55,6 +32,9 @@ var NowTimeFun = time.Now
 const DEFAULT_PATH_PATTERN = "/var/log/nginx/access.log*"
 const DEFAULT_DB_PATH = "./ngtop.db"
 
+// TODO replace with 'combined' once alias support is added
+const DEFAULT_LOG_FORMAT = `$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"`
+
 func main() {
 	// Optionally enable internal logger
 	if os.Getenv("NGTOP_LOG") == "" {
@@ -71,12 +51,17 @@ func main() {
 		logPathPattern = envLogsPath
 	}
 
+	logFormat := DEFAULT_LOG_FORMAT
+	if envLogFormat := os.Getenv("NGTOP_LOG_FORMAT"); envLogFormat != "" {
+		logFormat = envLogFormat
+	}
+
 	ctx, spec := querySpecFromCLI()
 	dbs, err := InitDB(dbPath)
 	ctx.FatalIfErrorf(err)
 	defer dbs.Close()
 
-	err = loadLogs(logPathPattern, dbs)
+	err = loadLogs(logFormat, logPathPattern, dbs)
 	ctx.FatalIfErrorf(err)
 
 	columnNames, rowValues, err := dbs.QueryTop(spec)
@@ -87,8 +72,8 @@ func main() {
 // Parse the command line arguments into a top requests query specification
 func querySpecFromCLI() (*kong.Context, *RequestCountSpec) {
 	// Parse query spec first, i.e. don't bother with db updates if the command is invalid
-	fieldNames := make([]string, 0, len(FIELD_NAMES))
-	for k := range FIELD_NAMES {
+	fieldNames := make([]string, 0, len(CLI_NAME_TO_FIELD))
+	for k := range CLI_NAME_TO_FIELD {
 		fieldNames = append(fieldNames, k)
 	}
 
@@ -111,7 +96,7 @@ func querySpecFromCLI() (*kong.Context, *RequestCountSpec) {
 	// translate field name aliases
 	columns := make([]string, len(cli.Fields))
 	for i, field := range cli.Fields {
-		columns[i] = FIELD_NAMES[field]
+		columns[i] = CLI_NAME_TO_FIELD[field].ColumnName
 	}
 
 	whereConditions, err := resolveWhereConditions(cli.Where)
@@ -144,10 +129,10 @@ func resolveWhereConditions(clauses []string) (map[string][]string, error) {
 			return nil, fmt.Errorf("invalid where expression %s", clause)
 		}
 
-		if column, found := FIELD_NAMES[keyvalue[0]]; !found {
-			return nil, fmt.Errorf("unknown field name %s", keyvalue[0])
+		if field, found := CLI_NAME_TO_FIELD[keyvalue[0]]; found {
+			conditions[field.ColumnName] = append(conditions[field.ColumnName], keyvalue[1])
 		} else {
-			conditions[column] = append(conditions[column], keyvalue[1])
+			return nil, fmt.Errorf("unknown field name %s", keyvalue[0])
 		}
 	}
 
@@ -187,21 +172,21 @@ func parseDuration(duration string) (time.Time, error) {
 }
 
 // Parse the most recent nginx access.logs and insert the ones not previously seen into the DB.
-func loadLogs(logPathPattern string, dbs *dbSession) error {
+func loadLogs(logFormat string, logPathPattern string, dbs *dbSession) error {
 	logFiles, err := filepath.Glob(logPathPattern)
 	if err != nil {
 		return err
 	}
 
 	// FIXME consolidate field list (duplicated knowledge)
-	dbColumns := []string{"ip", "time", "request_raw", "status", "bytes_sent", "referer", "user_agent_raw", "method", "path", "user_agent", "os", "device", "ua_url", "ua_type"}
+	dbColumns := []string{"ip", "time", "request_raw", "status", "referer", "user_agent_raw", "method", "path", "user_agent", "os", "device", "ua_url", "ua_type"}
 
 	lastSeenTime, err := dbs.PrepareForUpdate(dbColumns)
 	if err != nil {
 		return err
 	}
 
-	err = ProcessAccessLogs(logFiles, lastSeenTime, func(logLineFields map[string]interface{}) error {
+	err = ProcessAccessLogs(logFormat, logFiles, lastSeenTime, func(logLineFields map[string]string) error {
 		queryValues := make([]interface{}, len(dbColumns))
 		for i, field := range dbColumns {
 			queryValues[i] = logLineFields[field]
diff --git a/main_test.go b/main_test.go
index 6f41c75..c670b65 100644
--- a/main_test.go
+++ b/main_test.go
@@ -269,7 +269,7 @@ func runCommand(t *testing.T, logs string, cliArgs []string) ([]string, [][]stri
 	assertEqual(t, err, nil)
 	defer dbs.Close()
 
-	err = loadLogs(logFile.Name(), dbs)
+	err = loadLogs(DEFAULT_LOG_FORMAT, logFile.Name(), dbs)
 	assertEqual(t, err, nil)
 	columnNames, rowValues, err := dbs.QueryTop(spec)
 	assertEqual(t, err, nil)
diff --git a/parser.go b/parser.go
new file mode 100644
index 0000000..7977f58
--- /dev/null
+++ b/parser.go
@@ -0,0 +1,324 @@
+package main
+
+import (
+	"bufio"
+	"compress/gzip"
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"time"
+
+	"net/url"
+
+	"github.com/mileusna/useragent"
+)
+
+// TODO
+type LogField struct {
+	// TODO
+	LogFormatVar string
+	// TODO
+	CLINames []string
+	// TODO
+	ColumnName string
+	// TODO
+	ColumnSpec string
+	// TODO
+	Parse func(string) string
+	// TODO
+	ParseDerivedFields func(string) map[string]string
+}
+
+// TODO
+var KNOWN_FIELDS = []LogField{
+	{
+		LogFormatVar: "time_local",
+		ColumnName:   "time",
+		ColumnSpec:   "TIMESTAMP NOT NULL",
+		Parse:        parseTime,
+	},
+	{
+		LogFormatVar:       "request",
+		ColumnName:         "request_raw",
+		ColumnSpec:         "TEXT",
+		ParseDerivedFields: parseRequestDerivedFields,
+	},
+	{
+		LogFormatVar:       "http_user_agent",
+		ColumnName:         "user_agent_raw",
+		ColumnSpec:         "TEXT",
+		ParseDerivedFields: parseUserAgentDerivedFields,
+	},
+	{
+		LogFormatVar: "http_referer",
+		CLINames:     []string{"referer", "ref", "referrer"},
+		ColumnName:   "referer",
+		ColumnSpec:   "TEXT COLLATE NOCASE",
+		Parse:        stripUrlSource,
+	},
+	{
+		LogFormatVar: "remote_addr",
+		CLINames:     []string{"ip"},
+		ColumnName:   "ip",
+		ColumnSpec:   "TEXT",
+	},
+	{
+		LogFormatVar: "status",
+		CLINames:     []string{"status"},
+		ColumnName:   "status",
+		ColumnSpec:   "INTEGER",
+	},
+	{
+		CLINames:   []string{"method"},
+		ColumnName: "method",
+		ColumnSpec: "TEXT COLLATE NOCASE",
+	},
+	{
+		CLINames:   []string{"path", "url"},
+		ColumnName: "path",
+		ColumnSpec: "TEXT",
+	},
+	{
+		CLINames:   []string{"user_agent", "ua", "useragent"},
+		ColumnName: "user_agent",
+		ColumnSpec: "TEXT COLLATE NOCASE",
+	},
+	{
+		CLINames:   []string{"os"},
+		ColumnName: "os",
+		ColumnSpec: "TEXT COLLATE NOCASE",
+	},
+	{
+		CLINames:   []string{"device"},
+		ColumnName: "device",
+		ColumnSpec: "TEXT COLLATE NOCASE",
+	},
+	{
+		CLINames:   []string{"ua_url", "uaurl"},
+		ColumnName: "ua_url",
+		ColumnSpec: "TEXT",
+	},
+	{
+		CLINames:   []string{"ua_type", "uatype"},
+		ColumnName: "ua_type",
+		ColumnSpec: "TEXT COLLATE NOCASE",
+	},
+}
+
+var LOGVAR_TO_FIELD = map[string]*LogField{}
+var COLUMN_NAME_TO_FIELD = map[string]*LogField{}
+var CLI_NAME_TO_FIELD = map[string]*LogField{}
+
+func init() {
+	for _, field := range KNOWN_FIELDS {
+		COLUMN_NAME_TO_FIELD[field.ColumnName] = &field
+		if field.LogFormatVar != "" {
+			LOGVAR_TO_FIELD[field.LogFormatVar] = &field
+		}
+		for _, name := range field.CLINames {
+			CLI_NAME_TO_FIELD[name] = &field
+		}
+	}
+}
+
+const LOG_DATE_LAYOUT = "02/Jan/2006:15:04:05 -0700"
+
+// Parse the fields in the nginx access logs since the `until` time, passing them as a map into the `processFun`.
+// Processing is interrupted when a log older than `until` is found.
+func ProcessAccessLogs(
+	logFormat string,
+	logFiles []string,
+	until *time.Time,
+	processFun func(map[string]string) error,
+) error {
+	logPattern := formatToRegex(logFormat)
+
+	var untilStr string
+	if until != nil {
+		untilStr = until.Format(DB_DATE_LAYOUT)
+	}
+
+	for _, path := range logFiles {
+
+		log.Printf("parsing %s", path)
+		file, err := os.Open(path)
+		if err != nil {
+			return err
+		}
+		defer file.Close()
+
+		// if it's gzipped, wrap in a decompressing reader
+		var reader io.Reader = file
+		if filepath.Ext(path) == ".gz" {
+			if reader, err = gzip.NewReader(file); err != nil {
+				return err
+			}
+		}
+
+		scanner := bufio.NewScanner(reader)
+		for scanner.Scan() {
+			line := scanner.Text()
+			values, err := parseLogLine(logPattern, line)
+			if err != nil {
+				return err
+			}
+			if values == nil {
+				log.Printf("couldn't parse line %s", line)
+				continue
+			}
+
+			if untilStr != "" && values["time"] < untilStr {
+				// already caught up, no need to continue processing
+				return nil
+			}
+
+			if err := processFun(values); err != nil {
+				return err
+			}
+		}
+		if err := scanner.Err(); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// TODO
+func formatToRegex(format string) *regexp.Regexp {
+	chars := []rune(format)
+	var newFormat string
+
+	// previousWasSpace is used to tell, when a var is found, if it is expected to contain spaces
+	// without knowing which characters are used to sorround it, eg: "$http_user_agent" [$time_local]
+	previousWasSpace := true
+	for i := 0; i < len(chars); i++ {
+		if chars[i] != '$' {
+			previousWasSpace = chars[i] == ' '
+			newFormat += regexp.QuoteMeta(string(chars[i]))
+		} else {
+			// found a varname, process it
+			varname := ""
+			for j := i + 1; j < len(format) && ((chars[j] >= 'a' && chars[j] <= 'z') || chars[j] == '_'); j++ {
+				varname += string(chars[j])
+			}
+			i += len(varname)
+
+			// write the proper capture group to the format regex pattern
+			if field, isKnownField := LOGVAR_TO_FIELD[varname]; isKnownField {
+				// if the var matches a field we care to extract, use a named group
+				groupname := field.ColumnName
+				if previousWasSpace {
+					newFormat += "(?P<" + groupname + ">\\S+)"
+				} else {
+					newFormat += "(?P<" + groupname + ">.*?)"
+				}
+			} else {
+				// otherwise just add a nameless group that ensures matching
+				if previousWasSpace {
+					newFormat += "(?:\\S+)"
+				} else {
+					newFormat += "(?:.*?)"
+				}
+			}
+
+		}
+	}
+	return regexp.MustCompile(newFormat)
+}
+
+func parseLogLine(pattern *regexp.Regexp, line string) (map[string]string, error) {
+	match := pattern.FindStringSubmatch(line)
+	if match == nil {
+		return nil, fmt.Errorf("log line didn't match format:\nformat:%s\nline:%s", pattern, line)
+	}
+
+	result := make(map[string]string)
+	for i, name := range pattern.SubexpNames() {
+		field := COLUMN_NAME_TO_FIELD[name]
+		if i != 0 && name != "" && match[i] != "-" {
+			if field.Parse != nil {
+				result[name] = field.Parse(match[i])
+			} else {
+				result[name] = match[i]
+			}
+
+			if field.ParseDerivedFields != nil {
+				for key, value := range field.ParseDerivedFields(match[i]) {
+					result[key] = value
+				}
+			}
+		}
+	}
+	return result, nil
+}
+
+func stripUrlSource(value string) string {
+	value = strings.TrimPrefix(value, "http://")
+	value = strings.TrimPrefix(value, "https://")
+	value = strings.TrimPrefix(value, "www.")
+	value = strings.TrimSuffix(value, "/")
+	return value
+}
+
+// FIXME error instead of panic?
+func parseTime(timestamp string) string {
+	t, err := time.Parse(LOG_DATE_LAYOUT, timestamp)
+	if err != nil {
+		panic("can't parse log timestamp " + timestamp)
+	}
+	return t.Format(DB_DATE_LAYOUT)
+}
+
+func parseRequestDerivedFields(request string) map[string]string {
+	result := make(map[string]string)
+	request_parts := strings.Split(request, " ")
+	if len(request_parts) == 3 {
+		// if the request line is weird, don't try to extract its fields
+		result["method"] = request_parts[0]
+		raw_path := request_parts[1]
+		if url, err := url.Parse(raw_path); err == nil {
+			result["path"] = url.Path
+
+			// if utm source and friends in query, use them as referer
+			keys := []string{"ref", "referer", "referrer", "utm_source"}
+			query := url.Query()
+			for _, key := range keys {
+				if query.Has(key) {
+					result["referer"] = stripUrlSource(query.Get(key))
+					break
+				}
+			}
+
+		} else {
+			result["path"] = raw_path
+		}
+	}
+
+	return result
+}
+
+func parseUserAgentDerivedFields(ua string) map[string]string {
+	result := make(map[string]string)
+	if ua != "" {
+		ua := useragent.Parse(ua)
+		result["user_agent"] = ua.Name
+		result["os"] = ua.OS
+		result["device"] = ua.Device
+		result["ua_url"] = stripUrlSource(ua.URL)
+		if ua.Bot {
+			result["ua_type"] = "bot"
+		} else if ua.Tablet {
+			result["ua_type"] = "tablet"
+		} else if ua.Mobile {
+			result["ua_type"] = "mobile"
+		} else if ua.Desktop {
+			result["ua_type"] = "desktop"
+		}
+	}
+	return result
+}
diff --git a/parser_test.go b/parser_test.go
new file mode 100644
index 0000000..1f2eb3e
--- /dev/null
+++ b/parser_test.go
@@ -0,0 +1,27 @@
+package main
+
+import (
+	"testing"
+)
+
+func TestFormatRegex(t *testing.T) {
+	line := `xx.xx.xx.xx - - [24/Jul/2024:00:00:28 +0000] "GET /feed HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36"`
+
+	pattern := formatToRegex(DEFAULT_LOG_FORMAT)
+	result, err := parseLogLine(pattern, line)
+	assertEqual(t, err, nil)
+
+	assertEqual(t, result["ip"], "xx.xx.xx.xx")
+	assertEqual(t, result["time"], "2024-07-24 00:00:28+00:00")
+	assertEqual(t, result["request_raw"], "GET /feed HTTP/1.1")
+	assertEqual(t, result["status"], "301")
+	assertEqual(t, result["referer"], "")
+	assertEqual(t, result["user_agent_raw"], "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36")
+
+	// derived fields
+	assertEqual(t, result["method"], "GET")
+	assertEqual(t, result["path"], "/feed")
+	assertEqual(t, result["user_agent"], "Chrome")
+	assertEqual(t, result["ua_type"], "desktop")
+	assertEqual(t, result["os"], "Windows")
+}