Rules (XQL)
[INGEST:vendor="infoblox", product="infoblox", target_dataset="infoblox_infoblox_raw", no_hit=keep]
/*
This parsing rule normalizes timestamps from Infoblox logs that may include one of three
supported timestamp formats, extracted into the following variables:
1) tmp_dns_timestamp
• Applies to DNS Queries & Responses events that contain an internal timestamp
within the syslog message payload.
• Format: <dd-Mmm-YYYY HH:MM:SS.uuu>
Example: "18-Jan-2024 13:03:44.821"
• Timezone: Interpreted as GMT+0 (UTC).
• Reference: https://docs.infoblox.com/space/nios85/35816694/Capturing+DNS+Queries+and+Responses
2) tmp_direct_timestamp
• Applies to syslog messages sent directly from Infoblox (excluding DNS Q/R).
• Format: <Mmm dd hh:mm:ss> — RFC 3164 style (no year, no timezone).
Examples: "Jan 9 21:30:48", "Jan 18 21:30:48"
• Timezone: Interpreted as GMT+0 (UTC).
• Year: Derived from the current year.
3) tmp_syslog_timestamp
• Applies to syslog messages sent indirectly via an intermediate syslog client
that uses RFC 5424-compatible formatting.
• Formats:
"YYYY-MM-DDThh:mm:ss.sssZ"
"YYYY-MM-DDThh:mm:ss.ssssss±HH:MM"
Examples: "2023-10-29T11:18:59.123Z", "2023-10-29T11:18:59.123456-06:00"
• Timezone: Extracted directly from the timestamp (Z normalized to +00:00).
The parser selects the most appropriate timestamp in this order of precedence:
1) DNS (application event time)
2) RFC 5424 (header time with timezone)
3) Direct Infoblox (RFC 3164 style, derived year)
*/
filter _raw_log ~= "\d{4}\-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}\.\d+([+-]\d{2}:\d{2}|Z)" or _raw_log ~= "\d{2}\-\w{3}\-\d{4}\s+\d{2}:\d{2}:\d{2}\.\d{3}" or _raw_log ~= "\<\d+\>\w{3}\s+\d{1,2}\s+\d{2}\:\d{2}\:\d{2}\s+"
| alter tmp_current_year = to_string(format_timestamp("%Y",current_time()))
| alter tmp_dns_timestamp = arrayindex(regextract(_raw_log, "\d{2}\-\w{3}\-\d{4}\s+\d{2}:\d{2}:\d{2}\.\d{3}"), 0),
tmp_direct_timestamp = concat(tmp_current_year, " ", arrayindex(regextract( _raw_log, "\<\d+\>(\w{3}\s+\d{1,2}\s+\d{2}\:\d{2}\:\d{2})\s+"), 0)),
tmp_syslog_timestamp = replace(arrayindex(regextract(_raw_log, "\d{4}\-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}\.\d+(?:[+-]\d{2}:\d{2}|Z)"), 0), "Z", "+00:00") // normalize zulu time timezone to a numeric offset
| alter _time = if(tmp_dns_timestamp != null and tmp_dns_timestamp != "", parse_timestamp("%d-%b-%Y %H:%M:%E*S", tmp_dns_timestamp) , tmp_syslog_timestamp!= null and tmp_syslog_timestamp != "",parse_timestamp("%FT%H:%M:%E*S%Ez", tmp_syslog_timestamp), tmp_direct_timestamp != null and tmp_direct_timestamp != "", parse_timestamp("%Y %b %e %H:%M:%S", tmp_direct_timestamp))
| fields - tmp*; // Remove all temporary util fields