liblognorm is a tool to normalize log data. It takes logs in different formats as input and outputs the data within them in a single, consistent format. For example, if you have traffic logs from three different firewalls, liblognorm will be able to normalize all the events into a generic form. Among other features, it can extract source and destination IP addresses and ports and make them available via well-defined fields. The result is that a common log analysis application will be able to work on that common set independently from the actual firewalls feeding it. Even better, once a well-understood interim format exists, it is also easy to convert that into any other vendor specific format, so that you can use that vendor's analysis tool.
Libee is an event expression library that is inspired by the upcoming CEE standard. Right now, it provides capabilities to generate and emit messages in a set of standard formats and read a set of different input formats. Libee also comes with a handy conversion tool that provides format transformation without the need to program.