[INGEST:vendor="linux", product="linux", target_dataset="linux_linux_raw", no_hit=drop]
filter _raw_log ~= "^(?:<\d+>\s*)?\d{4}\-\d{2}\-\d{2}[T\s]\d{2}:\d{2}:\d{2}(?:\.\d+)?\s*(?:[+-]\d{2}:?\d{2}|Z)" and _raw_log not contains "kubelet-serving: Certificate expiration"
| alter tmp_json_payload = arrayindex(regextract(_raw_log, "({.+})"), 0)
| alter tmp_timestamp = coalesce(
    tmp_json_payload -> time,
    tmp_json_payload -> Data.Client.CurrentDateTime, 
    arrayindex(regextract(_raw_log, "^(?:<\d+>\s*)?(\d{4}\-\d{2}\-\d{2}[T\s]\d{2}:\d{2}:\d{2}(?:\.\d+)?\s*(?:[+-]\d{2}:?\d{2}|Z))"), 0))
| alter
    tmp_date = arrayindex(regextract(tmp_timestamp, "(\d{4}\-\d{2}\-\d{2})"), 0), 
    tmp_time = arrayindex(regextract(tmp_timestamp, "(\d{2}:\d{2}:\d{2}(?:\.\d+)?)"), 0), 
    tmp_timezone_offset = arrayindex(regextract(tmp_timestamp, "((?:[+-]\d{2}:?\d{2}|Z$))"), 0) 
| alter tmp_formatted_timestamp = format_string("%sT%s%s", tmp_date, tmp_time, tmp_timezone_offset)
| alter _time = if(
    tmp_timezone_offset = "Z", parse_timestamp("%FT%H:%M:%E*SZ", tmp_formatted_timestamp),
    tmp_timezone_offset ~= "[+-]\d{4}", parse_timestamp("%FT%H:%M:%E*S%z", tmp_formatted_timestamp),
    tmp_timezone_offset ~= "[+-]\d{2}:\d{2}", parse_timestamp("%FT%H:%M:%E*S%Ez", tmp_formatted_timestamp))
| fields - tmp*;

filter _raw_log ~= "^(?:<\d+>\s*)?\d{4}\-\d{2}\-\d{2}[T\s]\d{2}:\d{2}:\d{2}(?:\.\d+)?\s[A-Z]{3}" and not _raw_log ~= "^(?:<\d+>\s*)?\d{4}\-\d{2}\-\d{2}[T\s]\d{2}:\d{2}:\d{2}(?:\.\d+)?\s*(?:[+-]\d{2}:?\d{2}|Z)"
| alter 
    tmp_timestamp_without_offset = arrayindex(regextract(_raw_log ,"^(?:<\d+>\s*)?(\d{4}\-\d{2}\-\d{2}[T\s]\d{2}:\d{2}:\d{2}(?:\.\d+)?)"),0) 
| alter 
    tmp_timestamp_without_offset = replace(tmp_timestamp_without_offset, "T", " ")
| alter 
    _time = parse_timestamp("%Y-%m-%d %H:%M:%E*S%Ez",concat(tmp_timestamp_without_offset,"-00:00"))
| fields -tmp*;

filter _collector_type != "XDR Collector" and _raw_log ~= "^(?:<\d+>\s*)?\w{3}\s+\d{1,2}\s\d{2}:\d{2}:\d{2}" and _raw_log !~= "^(?:<\d+>\s*)?\d{4}\-\d{2}\-\d{2}[T\s]\d{2}:\d{2}:\d{2}(?:\.\d+)?\s*(?:[+-]\d{2}:?\d{2}|Z)" and not _raw_log ~= "^(?:<\d+>\s*)?\d{4}\-\d{2}\-\d{2}[T\s]\d{2}:\d{2}:\d{2}(?:\.\d+)?\s[A-Z]+"
| alter
    tmp_current_year = format_timestamp("%Y", _insert_time), 
    tmp_rfc_3164_timestamp = arrayindex(regextract(_raw_log, "^(?:<\d+>\s*)?(\w{3}\s+\d{1,2}\s\d{2}:\d{2}:\d{2})"), 0)
| alter tmp_current_year_timestamp = parse_timestamp("%Y %b %e %H:%M:%S", concat(tmp_current_year, " ", tmp_rfc_3164_timestamp), "UTC") 
| alter _time = if(
    timestamp_diff(tmp_current_year_timestamp, current_time(), "MILLISECOND") <= 0, tmp_current_year_timestamp,
    parse_timestamp("%Y %b %e %H:%M:%S", concat(to_string(subtract(to_integer(tmp_current_year), 1)), " ", tmp_rfc_3164_timestamp), "UTC"))
| fields - tmp*;

/* Fallback: events in formats not supported for the reporting collector are assigned the collection time. */
filter not (_raw_log ~= "^(?:<\d+>\s*)?\d{4}\-\d{2}\-\d{2}[T\s]\d{2}:\d{2}:\d{2}(?:\.\d+)?\s*(?:[+-]\d{2}:?\d{2}|Z)" and _raw_log not contains "kubelet-serving: Certificate expiration")
    and not _raw_log ~= "^(?:<\d+>\s*)?\d{4}\-\d{2}\-\d{2}[T\s]\d{2}:\d{2}:\d{2}(?:\.\d+)?\s[A-Z]{3}"
    and not (_collector_type != "XDR Collector" and _raw_log ~= "^(?:<\d+>\s*)?\w{3}\s+\d{1,2}\s\d{2}:\d{2}:\d{2}")
| alter _time = _insert_time;