If you dont want to change the timezone format on the device itself (its configurable) you could switch from a Syslog input to a UDP and TCP input and perform the syslog parsing with a beat processor.
I'd have to see the messages that are parsing correctly to figure out why they might be parsing correctly.