Details
| ID | F5_APM_ParsingRule |
|---|---|
| From Version | 8.4.0 |
Rules (XQL)
[INGEST:vendor = "f5", product = "apm", target_dataset = "f5_apm_raw", no_hit = keep]
// Timestamp ingestion in ISO format: YYYY-MM-DDThh:mm:ssTZ
filter _raw_log ~= "\d{4}\-\d{1,2}\-\d{1,2}T\d{2}:\d{2}:\d{2}[+-]\d{2}:\d{2}"
| alter
_time = parse_timestamp("%FT%T%Ez", arrayindex(regextract(_raw_log, "\d{4}\-\d{1,2}\-\d{1,2}T\d{2}:\d{2}:\d{2}[+-]\d{2}:\d{2}"), 0));