UDP regex should be lowercase

[rcork]

in my pfSense logs (2.3.3-RELEASE-p1), protocol is always lowercase. Your regex is looking for uppercase UDP so I had to modify to look for lowercase udp.

[waza-ari]

This seems to be true for IPv4 packets. When looking at IPv6 packets, it is indeed written uppercase. Kind of strange...