Rules (XQL)
[INGEST:vendor="cisco", product="asr", target_dataset="cisco_asr_raw", no_hit=keep]
/*
This parsing rule only supports datetime values with milliseconds in the UTC timezone.
The supported formats are:
- MMM dd hh:mm:ss.nnn (eg. Jan 01 10:00:00.123)
- yyyy MMM dd hh:mm:ss.nnn TZ (eg. 2021 Jan 01 10:00:00.123 UTC)
- MMM dd yyyy hh:mm:ss.nnn TZ (eg. Jan 01 2021 10:00:00.123 UTC).
*/
filter _raw_log ~= "\:[^\:]+\s\d{2}:\d{2}:\d{2}[^\:]+\:"
| alter
tmp_get_log_datetime = arraystring(regextract(_raw_log, "\:([^\:]+\s\d{2}:\d{2}:\d{2}[^\:]+)\:"), "")
| alter
tmp_get_year = if(tmp_get_log_datetime ~= "\d{4}", arraystring(regextract(tmp_get_log_datetime, "\d{4}"), ""), "1970"),
tmp_get_time_milli = arraystring(regextract(tmp_get_log_datetime, "\d{2}:\d{2}:\d{2}\.\d{3}"), ""),
tmp_get_month_day = arraystring(regextract(tmp_get_log_datetime, "(\w+\s+\d+)\s"), "")
| alter
tmp_full_timestamp = arraystring(arraycreate(tmp_get_year, tmp_get_month_day, tmp_get_time_milli), " ")
| alter
_time = if(tmp_full_timestamp ~= "1970", _insert_time, parse_timestamp("%Y %h %e %H:%M:%E3S", tmp_full_timestamp))
| fields -tmp_get_log_datetime, tmp_get_year, tmp_get_time_milli, tmp_get_month_day, tmp_full_timestamp;