Can phyton script modify a log event on the fly in a universal forwarder?

[lpolo]

Can a phyton script modify a log event on the fly in a universal forwarder?

For example:

file.log:

timestamp <id=xxxx>{
json content
}

log event to be forwarded:

file.log:

{
"timestamp : "xx/xx/xx:xx:xx:xx",
"id" : "xxxx"
json content
}

Thanks for your guidance.

LP

[dwaddle]

This cannot be done at the Universal Forwarder. I'm not even sure it can be (simply) done at the indexer.