Date does not convert date/time string properly

I have the following input date , time string as input:
Date == 03OCT17
Hour == 20
Minute == 45
These 3 fields are combined into a single string. "03OCT17:20:45". where the timezone is

mutate {
	add_field =>  { "timestamp" => "%{Obs Date}:%{Obs Hour}:45" }

The date generated by mutate above is parsed as shown below:
date {
match => [ "timestamp", "ddMMMyy:HH:m" ]
target => "@timestamp"

Therefore , input string as seen by date parser is:
"timestamp" => "03OCT17:20:45",
Output result is :
"@timestamp" => 2017-10-04T00:45:00.000Z,
"1) Why is the day wrong in the "@timestamp" . It is shown as 04 instead of 03.
2) Why is the hour wrong in the "@timestamp". It is shown as T00 instead of T20
I have tried this using timezone of -5:00 and still don't get the right day/hour.
There is no dateparseerror output.

The @timestamp field is UTC. Presumably your local timezone is UTC-4 so 2017-10-03T20:45-0400 is correctly converted to 2017-10-04T00:45+0000.

Thanks Magnus.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.