[INGEST:vendor="cisco", product="asa", target_dataset="cisco_asa_raw", no_hit = keep]
alter _json = parse_cisco(_raw_log)
| alter
        tmp_time = _json -> date
| alter
        _time = if(tmp_time contains "Z", parse_timestamp("%Y-%m-%dT%H:%M:%SZ", tmp_time), tmp_time ~= "[+-]\d{1,2}:\d{1,2}", parse_timestamp("%Y-%m-%dT%H:%M:%S%Ez", tmp_time))
| fields - tmp_time;