Dell EMC Unity Parsing Rule

Details

Rules (XQL)

[INGEST:vendor="dell_emc", product="unity", target_dataset="dell_emc_unity_raw", no_hit=keep]
/* Supports RFC 5424 compatible timestamps format, which include fractional seconds precision up to 6 digits, for example: 2023-10-29T11:18:59.123456+03:00 */
filter _raw_log ~= "\d{4}\-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[-+]\d{2}\:\d{2})"
| alter tmp_raw_timestamp = arrayindex(regextract(_raw_log, "\d{4}\-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[-+]\d{2}\:\d{2})"), 0)
| alter tmp_time = parse_timestamp("%Y-%m-%dT%H:%M:%E*S%Ez",tmp_raw_timestamp)
| alter _time = tmp_time 
| fields - tmp*;

[INGEST:vendor="dell", product="emc_unity", target_dataset="dell_emc_unity_raw", no_hit=keep]
/* Supports RFC 5424 compatible timestamps format, which include fractional seconds precision up to 6 digits, for example: 2023-10-29T11:18:59.123456+03:00 */
filter _raw_log ~= "\d{4}\-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[-+]\d{2}\:\d{2})"
| alter tmp_raw_timestamp = arrayindex(regextract(_raw_log, "\d{4}\-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[-+]\d{2}\:\d{2})"), 0)
| alter tmp_time = parse_timestamp("%Y-%m-%dT%H:%M:%E*S%Ez",tmp_raw_timestamp)
| alter _time = tmp_time 
| fields - tmp*;