Function parse_hec_time 

fn parse_hec_time(value: &Value) -> Option<DateTime<Utc>>

HEC time: epoch seconds (optionally fractional); values past ~1e12 are read as milliseconds. None if absent/unparseable (caller falls back to ingest time).