Corelight Zeek Parsing Rules

[INGEST:vendor="corelight", product="zeek", target_dataset="corelight_zeek_raw", no_hit=keep]
filter to_string(ts) ~= ".*\d{2}:\d{2}:\d{2}.*"
| alter _time = ts;