According to the docs, valid timezones are listed on this page, and CST is not one of them. Is that the same as CST6CDT?
mutate { gsub => [ "message", "CST", "CST6CDT" ] }
date { match => [ "message", "MMM d, yyyy HH:mm:ss a ZZZ" ] }
2 Likes