<123>2024-01-11T11:11:11.123Z hostname
I want to remove two fields from the above rohdaten using normalization, so to say. After normalization I should have the following fields:
milliseconds=123
log_ts=2024-01-11T11:11:11Z
Can I do this in normalization (or signature)? If yes, can you write me the normalization/signature rule?
This problem can be solved like this:
| <<:int>><log_ts:datetime_m> <host:all>
but I don't want that. I want to separate my fields at the beginning using normalization.