After the API Gateway is upgraded from any version to 9.4, the syslog headers and logs include the millisecond timestamp. The default time format in 9.4 is:
MMM d hh:mm:ss.SSS
The extra milliseconds format "SSS" causes issues in parsing with some monitoring tools.
Configurable timestamp was introduced in 9.4 CR2 with a new audit-related cluster property - syslog.dateFormat. It allows format modification of the syslog date-time format.
To resolve this issue, upgrade to 9.4 CR2 first and then use this property per your needs.