Fluentd/Bindplane wrong timestamp for collecting HAProxy logs - fluentd

Question

I'm facing an issue when I send the logs generated from HAProxy to Google Blindplane.
The log time format is "%b %d %H:%M:%S", and GCP stackdriver logs accepted format is UTC such as this form "2020-10-12T07:20:50.52Z".
When I try to transform the log time it doesn't show the right log time, it only shows the time of which I ran fluentd service neglecting the log real time.
I've tried couple of ways using fluentd time_format, Ruby time.Parse(), & Ruby time.strptime() none of them worked.
Here's the config for collecting HAProxy logs
<source>
#type tail
tag varnish.haproxy
path e:/haproxy/log/haproxy.log*
pos_file 'C:\Program Files (x86)\Stackdriver\LoggingAgent\Main\pos\varnish_haproxy.pos'
<parse>
#type multiline
format_firstline /\w{3} \d{2} \d{2}:\d{2}:\d{2}/
format1 /(?<message>.*)/
</parse>
read_from_head true
refresh_interval 2
</source>
<filter varnish.haproxy>
#type parser
key_name message
remove_key_name_field false
reserve_data true
reserve_time true
<parse>
#type multiline
format_firstline /\w{3} \d{2} \d{2}:\d{2}:\d{2}/
format1 /(?<timestamp>\w{3} \d{2} \d{2}:\d{2}:\d{2}) (?<servername>[^\s]) (?<ps>[^\[]+)(?<pid>\[[^\]]+\]): (?<client_ip>[\w\.]+):(?<client_port>\d+) \[(?<request_date>.+)\] (?<frontend_name>[\w\.-]+)~ (?<backend_name>[\w\.-]+)\/(?<server_name>[\w\.-]+) (?<TR>\d+)\/(?<Tw>\d+)\/(?<Tc>\d+)\/(?<Tr>\d+)\/(?<Ta>\d+) (?<status_code>\d+) (?<bytes_read>\d+) (?<captured_request_cookie>.+) (?<captured_response_cookie>.+) (?<termination_state>.+) (?<actconn>\d+)\/(?<feconn>\d+)\/(?<beconn>\d+)\/(?<srv_conn>\d+)\/(?<retries>\d+) (?<srv_queue>\d+)\/(?<backend_queue>\d+) \"(?<message>.*)\"/
</parse>
</filter>
<filter varnish.haproxy>
#type record_transformer
enable_ruby
<record>
timestamp ${t = Time.parse(record['timestamp']).utc; {'seconds' => t.tv_sec, 'nanos' => t.tv_nsec}}
</record>
</filter>
the log file sample:
Jun 23 14:00:00 localhost haproxy[26781]: xx.xx.xx.xxx:xxxxx [23/Jun/2021:14:00:00.561] https-in~ nodes-http/xxxxxxxx 0/0/0/314/314 200 278 - - --NI 274/274/100/23/0 0/0 "GET /api/customer/xxxxxxxx HTTP/1.1"
Jun 23 14:00:00 localhost haproxy[26781]: xx.xx.xx.xxx:xxxxxx [23/Jun/2021:13:59:59.901] https-in~ nodes-http/xxxxxxxxx 0/0/1/994/995 200 1485 - - --NI 274/274/100/22/0 0/0 "GET /api/customer/view HTTP/1.1"
Here's the screenshot from GCP logging timestamp

Answer 1

Have you tried using Time.strftime?
timestamp ${Time.parse(record['timestamp']).strftime("%Y-%m-%dT%k:%M:%S:00Z")}
I assumed the nano seconds would be non-important since it seems that fluentd doesn't provide them.