I am using Splunk 7.3.0 to ingest JSON Lines where the event timestamp is in ISO 8601 extended format.
In this particular JSON Lines, which is from a proprietary source, the event timestamp is the first timestamp value in each incoming line.
By first, I am referring to the serialized JSON Lines input data, which might arrive in Splunk over a TCP network or from a file. I am aware of the following text in the JSON standard (ECMA-404😞
The JSON syntax ... does not assign any significance to the ordering of name/value pairs. ... [This] may be defined by JSON processors or in specifications defining specific uses of JSON for data interchange.
The position of the event timestamp in each line is variable. And the event timestamp is not always associated with the same JSON property name.
Here are two simplified examples of lines of the incoming JSON Lines:
In TIME_PREFIX, I'm using a lookahead to identify the first occurrence in the line of a string that matches the start of an ISO 8601 extended format timestamp, such as 2019-10-30T...
I could extend the TIME_PREFIX to include the pattern of the subsequent time component, but I've chosen to limit the amount of regex processing, and quit at the "T" separator. Knowing my data, this is a safe match.