Rules (XQL)
[INGEST:vendor="aws", product="waf", target_dataset="aws_waf_raw", no_hit=keep]
// Supports Epoch (Unix time) timestamp in either seconds, milliseconds, microseconds or nanoseconds
filter to_string(timestamp) ~= "\d{10}|\d{13}|\d{16}|\d{19}"
| alter tmp_epoch_string = to_string(timestamp)
| alter tmp_epoch_int = to_integer(tmp_epoch_string),
tmp_len = to_integer(len(tmp_epoch_string))
| alter tmp_time = if(
// in_case of nanoseconds, we convert them to microseconds since to_timestamp does not support nanoseconds
tmp_len = 10, to_timestamp(tmp_epoch_int, "SECONDS"),
tmp_len = 13, to_timestamp(tmp_epoch_int, "MILLIS"),
tmp_len = 16, to_timestamp(tmp_epoch_int, "MICROS"),
tmp_len = 19, to_timestamp(floor(divide(tmp_epoch_int, 1000)), "MICROS"))
| alter _time = tmp_time
| fields -tmp*;