[INGEST:vendor="barracuda", product="cgfw", target_dataset="barracuda_cgfw_raw", no_hit=keep]
filter _raw_log ~= "^.*(\d{10})\s.*BYF" OR _raw_log ~= "\S{3}\s+\S+\s\d{2}\:\d{2}\:\d{2}"
| alter
    tmp_time1_get_epoch = arraystring(regextract(_raw_log, "^.*(\d{10})\s.*BYF"), ""),
    tmp_time2_gen_year = arraystring(regextract(to_string(_insert_time) , "^.{0,4}"),""), // 2023
    tmp_time2_get_datetime_log = replace(arraystring(regextract(_raw_log , "\S{3}\s+\S+\s\d{2}\:\d{2}\:\d{2}"), ""), "  ", " "), // Mar 13 07:11:42
    parsedFields1 = if(_raw_log ~= "BYF", regexcapture(_raw_log, "\w{3}\s+\d{1,2}\s\d{2}\:\d{2}\:\d{2}\s(?P<hostname>\S+)\s(?P<programName>\w+)\[(?P<pid>d*)\]\:\s\S+\s\S+\s(?P<srcIP>\S+)\s(?P<dstIP>\S+)\s(?P<contentType>\S+)\s\S+\s(?P<url>\S+)\s\d+\s(?P<type>\w+)\s(?P<action>\w+)\s\w+\s+\d+\s\d+\s\d+\s(?P<actionCode>\d+)\s\d+\s\S+\s\d+\s+(?P<urlCategoryCode>\S+)\s\S+\s\S+\s(?P<targetHostname>\S+)\s+.*\[(?P<targetUser>[^\]]+)"), regexcapture(_raw_log, "\w{3}\s+\d{1,2}\s\d{2}\:\d{2}\:\d{2}\s(?P<observerHostname1>\S+).+\:\s+(?P<level>\w+)\s+(?P<observerHostname2>\S+)\s(?P<action>\w+)\: type\=(?P<type>\w+)\|proto\=(?P<proto>\w+)\|srcIF\=(?P<srcIF>\w*)\|srcIP\=(?P<srcIP>\S*?)\|srcPort\=(?P<srcPort>\d*)\|srcMAC\=(?P<srcMAC>\S*?)\|dstIP\=(?P<dstIP>\S*?)\|dstPort\=(?P<dstPort>\d*)\|dstService\=(?P<dstService>\S*?)\|dstIF\=(?P<dstIF>\w*?)\|rule\=(?P<rule>\S*?)\|info\=(?P<info>.*?)\|srcNAT\=(?P<srcNAT>\S*?)\|dstNAT\=(?P<dstNAT>\S*?)\|duration\=(?P<duration>\d+)\|count\=(?P<count>\d+)\|receivedBytes\=(?P<receivedBytes>\d+)\|sentBytes\=(?P<sentBytes>\d+)\|receivedPackets\=(?P<receivedPackets>\d+)\|sentPackets\=(?P<sentPackets>\d+)\|user\=(?P<user>\S*?)\|protocol\=(?P<protocol>\w*)\|application\=(?P<application>.*?)\|target\=(?P<target>.*?)\|content\=(?P<content>.*?)\|urlcat\=(?P<urlcat>.*)"))
| alter
    tmp_time2_unite_format = tmp_time2_gen_year + " " + tmp_time2_get_datetime_log,
    parsedFields2 = if(to_string(parsedFields1) = """{}""", regexcapture(_raw_log, "\w{3}\s+\d{1,2}\s\d{2}\:\d{2}\:\d{2}\s(?P<observerHostname1>\S+).+?\:\s+(?P<level>\w+)\s+(?P<observerHostname2>\S+)\s(?P<message>.+)"))
| alter
    tmp_time2 = parse_timestamp("%Y %b %e %H:%M:%S", tmp_time2_unite_format)
| alter
    tmp_time1_convert = if (tmp_time1_get_epoch ~= "\d{10}", to_timestamp(to_integer(tmp_time1_get_epoch), "SECONDS"),null)
| alter
    tmp_final_time = coalesce(tmp_time1_convert, tmp_time2)
| alter
    tmp_diff_time = timestamp_diff(tmp_final_time , _insert_time , "MILLISECOND")
| alter
    tmp_time_after_check = if (tmp_diff_time > 0, parse_timestamp("%F %H:%M:%S%z", replace(to_string(tmp_time2), tmp_time2_gen_year, to_string(subtract (to_number(tmp_time2_gen_year), 1)))), tmp_final_time)
| alter
    _time = tmp_time_after_check
| fields -tmp_*;