use protocol_decode in log-parse