Rules (XQL)
[INGEST:vendor="google_workspace", product="drive", target_dataset="google_workspace_drive_raw", no_hit = keep]
filter id ~= "\"time\":[\"\s]+\d{4}-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}[\.\dZ]{1,5}\""
| alter
tmp_event_time_string = json_extract_scalar(id, "$.time"),
tmp_get_extensions = arraystring(regextract(id, "\"time\":[\"\s]+\d{4}-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}([\.\dZ]+)\""), "")
| alter
tmp_check_z = if(tmp_get_extensions ~= "^Z$", parse_timestamp("%Y-%m-%dT%H:%M:%SZ", tmp_event_time_string), null),
tmp_check_3ms = if(tmp_get_extensions ~= "\.\d{3}Z", parse_timestamp("%Y-%m-%dT%H:%M:%E3SZ", tmp_event_time_string), null)
| alter
tmp_pick_timestamp = coalesce(tmp_check_z, tmp_check_3ms)
| alter
_time = tmp_pick_timestamp
| fields -tmp_event_time_string, tmp_get_extensions, tmp_check_z, tmp_check_3ms, tmp_pick_timestamp;