The Google Cloud Security Community will be in read-only mode July 16 - July 22 as we migrate platforms. Read more and check out our FAQ.

[spartan_07]

I have a log : 
Sample : 

{
"DurationMilliseconds": "0",
"EventTimeUTC": "2025-05-17 22:03:50.054630200",
"EventTimeIST": "2025-05-18 03:33:50.054630200",
"EventTimeEventLog": "2025-05-17 22:03:50.245483700",
"DatabaseName": "UNIRISQ",
"SchemaName": "dbo",
"TransactionId": "8802688"
}

How do i parse EventTimeUTC or EventTimeIST to Event Time field. ? 
Can anyone help me regarding this?

[JeremyLand]

You'll be looking for the `date` function in the parser.  Theres a few examples in the docs that should get you what you need: 
https://cloud.google.com/chronicle/docs/reference/parser-syntax#date_function

The default output is to event_time so you won't need to specify a target, but you will need to include the TS format.

[spartan_07]

Can you help us with the code for the same?

[sudeep_singh]

date {
match => ["EventTimeUTC", "yyyy-MM-dd HH:mm:ss", "UNIX", "ISO8601", "UNIX_MS"]
target => "security_result.first_discovered_time"
on_error => "no_match"
}


Hi @spartan_07 ,

try it out with above code.