diff --git a/loggy.py b/loggy.py
index c788db7..92f676d 100644
--- a/loggy.py
+++ b/loggy.py
@@ -103,7 +103,8 @@
                     map_js: typing.Dict[str, typing.Dict[typing.Union[str, bool]]] = {
                         "_all": {"enabled": True},
                         "properties": {
-                            "@timestamp": {"store": True, "type": "date", "format": "yyyy/MM/dd HH:mm:ss"},
+                            "@timestamp": {"store": True, "type": "date", "format": "yyyy/MM/dd HH:mm:ss"},  # Time of logging to DB cluster
+                            "entry_timestamp": {"store": True, "type": "date", "format": "yyyy/MM/dd HH:mm:ss"},  # Optional timestamp in the log entry itself
                             "@node": {"store": True, "type": "keyword"},
                             "status": {"store": True, "type": "long"},
                             "date": {"store": True, "type": "keyword"},
@@ -157,6 +158,11 @@
                     js["url"] = match.group(2)
             if "bytes" in js and isinstance(js["bytes"], str) and js["bytes"].isdigit():
                 js["bytes_int"] = int(js["bytes"])
+            
+            # Convert entry timestamp to OpenSearch datetime format
+            if "entry_timestamp" in js and isinstance(js["entry_timestamp"], str) and js["entry_timestamp"].isdigit():
+                js["entry_timestamp"] = time.strftime("%Y/%m/%d %H:%M:%S", time.gmtime(int(js["entry_timestamp"])))
+
 
             js_arr.append({"_op_type": "index", "_index": iname, "doc": js, "_source": js})
 
diff --git a/logtypes.py b/logtypes.py
index 6f41da0..5b3f249 100644
--- a/logtypes.py
+++ b/logtypes.py
@@ -49,7 +49,7 @@
     "rsync": re.compile(r"(?P<date>\S+ \d+:\d+:[\d,]+)\s+" r"\[(?P<pid>[\S.]+)\]\s+" r"(?P<message>.+)"),
     "pylogs": re.compile(r"(?P<date>\S+ \S+)\s+\[pylog\]\s+" r"\[(?P<type>[\S.]+)\]:\s+" r"(?P<message>.+)"),
     "qmail": re.compile(r"(?P<mid>@[a-f0-9]+)\s+" r"(?P<message>.+)"),
-    "lastlog": re.compile(r"USER: (?P<user>([-.a-z0-9]+))\((?P<uid>(\d+))\);\s+T: \[(?P<time_txt>([^]]+))\]; LINE: (?P<term>(pts/\d+|tty\d+|system)); HOST: (?P<client_ip>[0-9a-f:.]+)"),
+    "lastlog": re.compile(r"USER: (?P<user>([-.a-z0-9]+))\((?P<uid>(\d+))\);\s+T: \[(?P<time_txt>([^]]+))\];(?: EPOCH: (?P<entry_timestamp>[0-9.]+);)? LINE: (?P<term>(pts/\d+|tty\d+|system)); HOST: (?P<client_ip>[0-9a-f:.]+)"),
 }
 
 # These names must agree with the regexes above
@@ -79,5 +79,5 @@
     "rsync": collections.namedtuple("rsync", ["date", "pid", "message", "filepath", "logtype", "timestamp"]),
     "pylogs": collections.namedtuple("pylogs", ["date", "type", "message", "filepath", "logtype", "timestamp"]),
     "qmail": collections.namedtuple("qmail", ["mid", "message", "filepath", "logtype", "timestamp"]),
-    "lastlog": collections.namedtuple("lastlog", ["user", "uid", "time_txt", "term", "client_ip", "filepath", "logtype", "timestamp"]),
+    "lastlog": collections.namedtuple("lastlog", ["user", "uid", "time_txt", "entry_timestamp", "term", "client_ip", "filepath", "logtype", "timestamp"]),
 }