rule "replace timestamp"
when
	true
then
	debug($message.timestamp);
	let new_date = parse_date(to_string($message.timestamp), "yyyy-MM-dd'T'HH:mm:ss", "BR", "BRT");
	set_field("timestamp", new_date);
	debug($message.timestamp);
end