Microsoft Azure Events Hub Parsing Rule

Details

Rules (XQL)

[INGEST:vendor="MSFT", product="Azure", target_dataset="msft_azure_raw", no_hit=keep]
alter timestampModify = time
| filter timestampModify contains "."
| alter splitStr = split(timestampModify, ".")
| alter epoch_s = to_string(to_epoch(parse_timestamp("%Y-%m-%dT%H:%M:%S", arrayindex(splitStr ,0)), "seconds")),
        epoch_ms = to_string(arrayindex(regextract(trim(arrayindex(splitStr, 1),"Z"),"^(\d{3})"),0))
| alter timestampModify = concat(epoch_s , epoch_ms)
| alter _time = to_timestamp(to_integer(timestampModify), "millis")
| fields -epoch_s, epoch_ms, splitStr, timestampModify;