[INGEST:vendor="infoblox", product="infoblox", target_dataset="infoblox_infoblox_raw", no_hit=keep]
/* 
   This parsing rule normalizes timestamps from Infoblox logs that may include one of three
   supported timestamp formats, extracted into the following variables:

   1) tmp_dns_timestamp  
      • Applies to DNS Queries & Responses events that contain an internal timestamp  
        within the syslog message payload.  
      • Format: <dd-Mmm-YYYY HH:MM:SS.uuu>  
        Example: "18-Jan-2024 13:03:44.821"  
      • Timezone: Interpreted as GMT+0 (UTC).  
      • Reference: https://docs.infoblox.com/space/nios85/35816694/Capturing+DNS+Queries+and+Responses  

   2) tmp_direct_timestamp  
      • Applies to syslog messages sent directly from Infoblox (excluding DNS Q/R).  
      • Format: <Mmm dd hh:mm:ss> — RFC 3164 style (no year, no timezone).  
        Examples: "Jan  9 21:30:48", "Jan 18 21:30:48"  
      • Timezone: Interpreted as GMT+0 (UTC).  
      • Year: Derived from the current year.  

   3) tmp_syslog_timestamp  
      • Applies to syslog messages sent indirectly via an intermediate syslog client  
        that uses RFC 5424-compatible formatting.  
      • Formats:  
          "YYYY-MM-DDThh:mm:ss.sssZ"  
          "YYYY-MM-DDThh:mm:ss.ssssss±HH:MM"  
        Examples: "2023-10-29T11:18:59.123Z", "2023-10-29T11:18:59.123456-06:00"  
      • Timezone: Extracted directly from the timestamp (Z normalized to +00:00).  

   The parser selects the most appropriate timestamp in this order of precedence:  
   1) DNS (application event time)  
   2) RFC 5424 (header time with timezone)  
   3) Direct Infoblox (RFC 3164 style, derived year)  
*/ 
filter _raw_log ~= "\d{4}\-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}\.\d+([+-]\d{2}:\d{2}|Z)" or _raw_log ~= "\d{2}\-\w{3}\-\d{4}\s+\d{2}:\d{2}:\d{2}\.\d{3}" or _raw_log ~= "\<\d+\>\w{3}\s+\d{1,2}\s+\d{2}\:\d{2}\:\d{2}\s+"
| alter tmp_current_year = to_string(format_timestamp("%Y",current_time()))
| alter tmp_dns_timestamp = arrayindex(regextract(_raw_log, "\d{2}\-\w{3}\-\d{4}\s+\d{2}:\d{2}:\d{2}\.\d{3}"), 0),
        tmp_direct_timestamp = concat(tmp_current_year, " ", arrayindex(regextract( _raw_log, "\<\d+\>(\w{3}\s+\d{1,2}\s+\d{2}\:\d{2}\:\d{2})\s+"), 0)),
        tmp_syslog_timestamp = replace(arrayindex(regextract(_raw_log, "\d{4}\-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}\.\d+(?:[+-]\d{2}:\d{2}|Z)"), 0), "Z", "+00:00") // normalize zulu time timezone to a numeric offset
| alter _time = if(tmp_dns_timestamp != null and tmp_dns_timestamp != "", parse_timestamp("%d-%b-%Y %H:%M:%E*S", tmp_dns_timestamp) , tmp_syslog_timestamp!= null and tmp_syslog_timestamp != "",parse_timestamp("%FT%H:%M:%E*S%Ez", tmp_syslog_timestamp), tmp_direct_timestamp != null and tmp_direct_timestamp != "", parse_timestamp("%Y %b %e %H:%M:%S", tmp_direct_timestamp))
| fields - tmp*; // Remove all temporary util fields