def format_extension
        extensions = CEF::EXTENSION_ATTRIBUTES.keys.map do |meth|
          value = self.send(meth)
          next if value.nil?
          shortname = CEF::EXTENSION_ATTRIBUTES[meth]
          [shortname, escape_extension_value(value)].join("=")
        end

        # make sure time comes out as milliseconds since epoch
        times = CEF::TIME_ATTRIBUTES.keys.map do |meth|
          value = self.send(meth)
          next if value.nil?
          shortname = CEF::TIME_ATTRIBUTES[meth]
          [shortname, escape_extension_value(value)].join("=")
        end
        (extensions + times).compact.join(" ")
      end
def format_extension
        extensions = CEF::EXTENSION_ATTRIBUTES.keys.map do |meth|
          value = self.send(meth)
          next if value.nil?
          shortname = CEF::EXTENSION_ATTRIBUTES[meth]
          [shortname, escape_extension_value(value)].join("=")
        end

        # make sure time comes out as milliseconds since epoch
        times = CEF::TIME_ATTRIBUTES.keys.map do |meth|
          value = self.send(meth)
          next if value.nil?
          shortname = CEF::TIME_ATTRIBUTES[meth]
          [shortname, escape_extension_value(value)].join("=")
        end
        (extensions + times).compact.join(" ")
      end
returns a space-delimeted list of attribute=value pairs for all optionals