parsers:
  - name: json
    format: json
    time_key: timestamp
    time_format: "%Y-%m-%d %H:%M:%S.%L%z"
  
  - name: intune_mdm_daemon
    format: regex
    regex: ^(?<intune_ts>\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}:\d{3})\s+\|\s+(?<intune_app>[^|]+?)\s+\|\s+(?<intune_level>[A-Z])\s+\|\s+(?<intune_pid>\d+)\s+\|\s+(?<intune_module>[^|]+?)\s+\|\s+(?<message>.*)$
    time_key: intune_ts
    time_format: '%Y-%m-%d %H:%M:%S:%L'