The first is the standard ELFF format:

date time time-taken c-ip sc-status s-action sc-bytes cs-bytes cs-method cs-uri-scheme cs-host cs-uri-stem cs-username s-hierarchy s-supplier-name rs(Content-Type) cs(User-Agent) sc-filter-result sc-filter-category x-virus-id s-ip s-sitename

The second format is not the default ELFF format, but allows LogLogic to parse or normalize a number of additional fields:

bytes c-dns c-ip cached cs(Content-Type) cs(Referer) cs(User-Agent) cs(X-Forwarded-For) cs-auth-group cs-auth-groups cs-method cs-types cs-uri cs-uri-query cs-uri-stem current-time date r-dns r-ip r-port rs(Content-Type) s-dns s-ip s-port sc-bytes sc-status time time-taken x-action x-connect-time x-hiercode x-play-time x-product x-protocol x-sc-contentlength x-smartfilter-categories x-smartfilter-result x-status x-timestamp x-transaction x-username x-virus-details x-virus-id