# BUG? - ISO8601 Timezone Parsing

**URL:** <https://discuss.elastic.co/t/bug-iso8601-timezone-parsing/149964>\
**Category:** Logstash\
**Created:** [September 26, 2018, 9:06am UTC](https://discuss.elastic.co/t/bug-iso8601-timezone-parsing/149964 "2018-09-26T09:06:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![leeroy](https://avatars.discourse-cdn.com/v4/letter/l/eb9ed0/32.png) [@leeroy](https://discuss.elastic.co/u/leeroy)\
**Post date:** [September 26, 2018, 9:06am UTC](https://discuss.elastic.co/t/bug-iso8601-timezone-parsing/149964/1 "2018-09-26T09:06:47Z")

</div>

I'm trying to parse the /var/log/install.log file on MacOS (I've checked 10.13.x and 10.14.0, they're the same syntax). Unfortunately it's lacking some consistency in date formats between various system logs, but that's not something I can control.

I've got filebeat forwarding to logstash just fine, I'm just having some difficulty with getting the syslog date -\> the timestamp field.

Snippits:

```
2018-09-26 15:12:25+08 iMac.local Installer[99213]: Will use PK session
2018-09-26 15:12:25+08 iMac.local Installer[99213]: Using authorization level of root for IFPKInstallElement

```

I'm using this grok filter, which fails on the timestamp because as far as I can tell, it's expecting +0800 rather than +08

```
grok {
match => { "message" => '%{TIMESTAMP_ISO8601:time} %{HOSTNAME:hostname} %{WORD:syslog_program}(?:\[%{NUMBER:syslog_pid}\])?: %{GREEDYDATA:syslog_message}' }
}

```

If I change the input text from +08 to +0800 it parses it correctly, which is what I'd expect from [the github repo with grok patterns](https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns)

```
ISO8601_TIMEZONE (?:Z|[+-]%{HOUR}(?::?%{MINUTE}))

```

[But if I check the ISO8601 standards, it looks like +xx is permitted](https://en.wikipedia.org/wiki/ISO_8601#Time_offsets_from_UTC):

> So if the time being described is one hour ahead of UTC (such as the time in [Berlin](https://en.wikipedia.org/wiki/Berlin) during the winter), the zone designator would be "+01:00", "+0100", or simply "+01".

I've worked around this by overwriting the `ISO8601_TIMEZONE` pattern in a custom pattern for these log files:

```
ISO8601_TIMEZONE (?:Z|[+-]%{HOUR}(?::?%{MINUTE})?)

```

The only change I've made between my pattern declaration and the inbuilt one is to make the non-capture group for minutes optional. Is this a bug? Should I be logging this as an issue in github?

Thanks.

EDIT: Also, the [date plugin seems to assume timezone will always be 4 digits](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-match), I'm not full bottle enough on logstash yet to know if the date plugin uses the same patterns or not (I assume not), but there may be a need (if this a bug that elastic would want fixed) additional code would need adjustment.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 24, 2018, 9:06am UTC](https://discuss.elastic.co/t/bug-iso8601-timezone-parsing/149964/2 "2018-10-24T09:06:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.