[INGEST:vendor="huawei", product="fw", target_dataset="huawei_fw_raw", no_hit = keep]
alter 
parsed_fields_headers = regexcapture(_raw_log, "<(?P<pri>\d{1,3})>(?P<timestamp>\w{3}\s\d{1,2}\s\d{4}\s\d{2}:\d{2}:\d{2})\s(?P<hostname>\S+)\s%?%?(?P<version_number>\d{2})(?P<module_name>\S+)\/(?P<severity_log_level>\d{1})\/(?P<log_brief>\S+)\((?P<log_identifier>\w+)\)\[(?P<log_serial_number>\d+)\]:\s?"),
parsed_fields_description = arrayindex(regextract(_raw_log , "<\d{1,3}>\w{3}\s\d{1,2}\s\d{4}\s\d{2}:\d{2}:\d{2}\s\S+\s%%\d{2}\S+\/\d{1}\/\S+\(\w+\)\[\d+\]:\s?(.*)"),0)

| alter 
    tmp_time = parse_timestamp("%h %d %Y %X" ,parsed_fields_headers -> timestamp)
| alter 
    _time = tmp_time
| fields -tmp_time;