Updated ProofPoint Pod Time Zone offset

Cargill · Jul 24, 2024 · c45c2d1 · c45c2d1
1 parent 2514873
commit c45c2d1
Showing 1 changed file with 2 additions and 13 deletions.
diff --git a/config/processors/api_security_proofpoint.pod_email_gateway.conf b/config/processors/api_security_proofpoint.pod_email_gateway.conf
@@ -116,30 +116,19 @@ filter {
       gsub => [ "[source][address]", "[\[\]]", "" ]
     }
   }
+  # "ts":"2024-07-24t13:52:24.333621-0500"
   date {
-    match => ["[event][created]","yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ"]
-    timezone => "GMT"
-    locale => "en"
+    match => ["[event][created]", "ISO8601"]
     target => "[event][created]"
     tag_on_failure => "_dateparsefailure_ec"
   }
-  if "_dateparsefailure_ec" in [tags]  {
-    mutate {
-      remove_field => ["[event][created]"]
-    }
-  }
   date {
     match => ["[event][start]","yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ"]
     timezone => "GMT"
     locale => "en"
     target => "[event][start]"
     tag_on_failure => "_dateparsefailure_es"
   }
-  if "_dateparsefailure_es" in [tags]  {
-    mutate {
-      remove_field => ["[event][start]"]
-    }
-  }
   mutate {
     remove_field => ["tmp_msg", "pp"]
   }