Two row variants: low-level Connection events and player join/disconnect events. The LINE regex accepts both shapes; analysers route via CONNECTION (action/index/guid/id) and PLAYER_EVENT (steamid/player/event) named-group regexes. Detectors: filename match plus content signatures on either variant.