<123>2024-01-11T11:11:11.123Z hostname
I want to remove two fields from the above rohdaten using normalization, so to say. After normalization I should have the following fields:
milliseconds=123
log_ts=2024-01-11T11:11:11Z

Can I do this in normalization (or signature)? If yes, can you write me the normalization/signature rule? 

This problem can be solved like this:

| <<:int>><log_ts:datetime_m> <host:all>

but I don't want that. I want to separate my fields at the beginning using normalization.