def opened_closed(logevent):
    """ inspects a log line and groups it by connection being openend or closed. If neither, return False. """
    if "connection accepted" in logevent.line_str:
        return "opened"
    elif "end connection" in logevent.line_str:
        return "closed"
    else:
        return False