Hi,
I'm trying to set up a source type that parses the date from an inner field (message.date in the below example) however the _time value is always set as the processed time. Any guesses as to what i might be doing wrong?
The configuration is as follows:
This is a sample event.
{"message":{"_id":"some_value","date":"2018-07-18T04:40:58.071Z","type":"fsa","description":"Login required","client_id":"some_value","client_name":"some_value","ip":"some_value","user_agent":"Chrome 67.0.3396 / Windows 10 0.0.0","details":{"body":{"tenant":"some_value"},"qs":{"client_id":"some_value","response_type":"id_token","response_mode":"web_message","redirect_uri":"some_value","scope":"openid email profile","audience":"some_value","leeway":"60","state":"some_value","nonce":"some_value","prompt":"none","auth0Client":"some_value","tenant":"hirer"},"connection":null,"error":{"message":"Login required","oauthError":"login_required","type":"oauth-authorization"}},"hostname":"a","session_connection":null,"session_connection_id":null,"audience":"o","scope":["openid","email","profile"],"isMobile":false},"severity":"info"}
... View more