audit.log and cloudwatch agent

What timestamp conversion code are you guys using for the auditd log file? Epoch time seems to not be supported, they all come through as one entry with many actual log lines. It seems like the audit log would have been an important one to support out of the box.