Like Ayn said, your life will be much easier if you extract timestamps from CSV.
Something like this in your props.conf should do it.
MAX_TIMESTAMP_LOOKAHEAD = 10
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TIME_FORMAT = %Y,%m,%d
EXTRACT-web_visitors = (?i)^\d+,\d+,\d+,(?P<source_from>[^,]+),(?P<visitors>.+)$
This should parse both timestamp and "from" & "visitors" -fields from your CSV.
And if CSV header gets annoying, here is some ideas what you can do for it
... View more