How can I handle a time stamp with flexible spaces?

[ddrillic]

We have a syslog data that was written to disk via the FULLDATE macro. For today, it looks like — 2019 Apr 3 19:30:01 with double space. I assume that it would be 2019 Apr 13 19:30:01 in ten days with only one space.

I wonder which format to use in props.conf -

TIME_FORMAT=%Y %b %d %H:%M:%S works fine for 2019 Apr 3 19:30:01 but not for 2019 Apr 13 19:30:01, which is counter intuitive to me.

On Unix, I see -

date "+%Y %b %d %H:%M:%S" as 2019 Apr 03 15:45:41. Apparently space and zero are interchangeable.

Any ideas?

[ddrillic]

This warning threw me off ; -)

[ddrillic]

It seems that it was my bad - it works just fine.