[INGEST:vendor="fireeye", product="mps", target_dataset="fireeye_mps_raw", no_hit = keep]
filter to_string(rt) ~= "\d{7,13}"
| alter _time = to_timestamp(to_integer(rt), "millis");