Some devices, particularly network devices, apparently don't have a battery clock and start logging before they sync to a time server. We have some that log to linux epoch 0 (1/1/1970), others to some 1980 date, some to just some randomly wrong date (maybe they have a battery clock that has drifted).
Yeah We know that they system is using some kind of timestamp from the physical hardware before the the correct time gets synced up which causes the problem of when the next log from that system gets entered we lose the the previous logs data because the system is restarted between uses. It's a weird dumb problem but unfortunately it is the way it is.
It could be done with an aggregate filter, but it will not be cheap. Basically if the date on the event is from 2000, shove it into the map, if the date is not from 2000, add the correct date to the map, then push the map as an event, then subsequently use a split filter to split the map into multiple events, and move the date to the correct field.