use _time from log parse result when it is available