rule "json message"
when
    has_field("json_regex")
then
    set_fields(to_map(parse_json(regex_replace(to_string($message.json_regex), to_string($message.message), "$1"))));
    set_field("source", $message.Source);
    remove_field("Source");
    set_field("timestamp", parse_date(to_string($message.Timestamp), "yyyy-MM-dd'T'HH:mm:ssZ"));
    remove_field("Timestamp");
end