My custom log schema uses a timestamp format of
%Y-%m-%d %H:%M:%S.%f %z. Some log entries come in without the microsecond part (
.%f). Is there a way to handle both timestamp formats (one with the
.%f and one without) in the same schema file without having to treat it as simple string?
Panther does not currently support multiple timestamp formats in a single schema.