ESI, Device with fixed width time stamp
It defaults to variable width, and unfortunately it doesn't work, since there is a space between the : and the single digit number, which throws off the parsing of the rest of the header.
May 03 14:00:07 [126.96.36.199 May 3 14: 0: 7 XXX-YYY-01 Alarm 'Link Down. Interface Index : 3 '
May 03 13:52:30 [188.8.131.52] May 3 13:52:30 XXX-YYY-01 Alarm 'Link Down. Interface Index : 3 '
I figured it out! I am using the Envision time stamp, and then assigned each part of the device timestamp to variables instead. That seems to allow me to parse the header correctly.
If there is a way to parse the device time stamp correctly I'd still like to know though...