Is it possible to convert the timestamp using this parser from '\w{3}\s+\d{1,2}\s\d{2}:\d{2}:\d{2}' to %Y-%m-%dT%H:%M:%S %z ? if so, how? i've tried various methods but were not successful.
my incoming log example format:
Jun 07 20:21:45 SERVER_NAME CEF:0|App-Name|Sub-Cat|12.1.0000|295|Retrieve password|5|act=Retrieve password suser=username fname=Root\Operating System-WindowsADServiceAccount-company.com-server01dev dvc=##.###.##.### shost==##.###.##.### dhost=company.com duser=username-dev externalId= app= reason= cs1Label="User Name" cs1= cs2Label="Some Name" cs2=Some Accounts - ABCD cs3Label="Device Type" cs3=Operating System cs4Label="LabelName" cs4= cs5Label="Other info" cs5==##.###.##.### cn1Label="Request Id" cn1= cn2Label="Ticket Id" cn2=(Action: Show Password) msg=(Action: Show Password)
Is it possible to convert the timestamp using this parser from '\w{3}\s+\d{1,2}\s\d{2}:\d{2}:\d{2}' to %Y-%m-%dT%H:%M:%S %z ? if so, how? i've tried various methods but were not successful.
my incoming log example format:
Jun 07 20:21:45 SERVER_NAME CEF:0|App-Name|Sub-Cat|12.1.0000|295|Retrieve password|5|act=Retrieve password suser=username fname=Root\Operating System-WindowsADServiceAccount-company.com-server01dev dvc=##.###.##.### shost==##.###.##.### dhost=company.com duser=username-dev externalId= app= reason= cs1Label="User Name" cs1= cs2Label="Some Name" cs2=Some Accounts - ABCD cs3Label="Device Type" cs3=Operating System cs4Label="LabelName" cs4= cs5Label="Other info" cs5==##.###.##.### cn1Label="Request Id" cn1= cn2Label="Ticket Id" cn2=(Action: Show Password) msg=(Action: Show Password)