MicrosoftExchangeServer Parsing Rule

[INGEST:vendor="msft", product="exchange", target_dataset="msft_exchange_raw", no_hit = keep]
filter date_time ~= "\d{2}\:\d{2}\:\d{2}"
| alter _time = date_time;