# Grok TIMESTAMP\_ISO8601 doesnot capture TZ

**URL:** <https://discuss.elastic.co/t/grok-timestamp-iso8601-doesnot-capture-tz/122765>\
**Category:** Logstash\
**Created:** [March 6, 2018, 6:17pm UTC](https://discuss.elastic.co/t/grok-timestamp-iso8601-doesnot-capture-tz/122765 "2018-03-06T18:17:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pfseth](https://avatars.discourse-cdn.com/v4/letter/p/e9bcb4/32.png) [@pfseth](https://discuss.elastic.co/u/pfseth)\
**Post date:** [March 6, 2018, 6:17pm UTC](https://discuss.elastic.co/t/grok-timestamp-iso8601-doesnot-capture-tz/122765/1 "2018-03-06T18:17:08Z")

</div>

How can i parse TZ using grok

```
2018-03-05 21:29:31 -0500,188c3263-2519-4a8d-825c-4605c53b720e

TIMESTAMP_ISO8601 does not capture -0500

```

Grok Debugger ...

```
{
  "TIMESTAMP_ISO8601": [
    [
      "2018-03-05 21:29:31"
    ]
  ],
  "YEAR": [
    [
      "2018"
    ]
  ],
  "MONTHNUM": [
    [
      "03"
    ]
  ],
  "MONTHDAY": [
    [
      "05"
    ]
  ],
  "HOUR": [
    [
      "21",
      null
    ]
  ],
  "MINUTE": [
    [
      "29",
      null
    ]
  ],
  "SECOND": [
    [
      "31"
    ]
  ],
  "ISO8601_TIMEZONE": [
    [
      null
    ]
  ]
}
```

---

<div class="post-metadata">

**Author:** ![pfseth](https://avatars.discourse-cdn.com/v4/letter/p/e9bcb4/32.png) [@pfseth](https://discuss.elastic.co/u/pfseth)\
**Post date:** [March 6, 2018, 9:06pm UTC](https://discuss.elastic.co/t/grok-timestamp-iso8601-doesnot-capture-tz/122765/2 "2018-03-06T21:06:51Z")

</div>

Is this efficient way to match ?

`(?<timestamp>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} [+-]*\d{4})\,%{UUID:session_id}`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 3, 2018, 9:06pm UTC](https://discuss.elastic.co/t/grok-timestamp-iso8601-doesnot-capture-tz/122765/3 "2018-04-03T21:06:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.