# Grok Timezone/DateTime parsing issues

**URL:** <https://discuss.elastic.co/t/grok-timezone-datetime-parsing-issues/137500>\
**Category:** Logstash\
**Created:** [June 26, 2018, 7:21pm UTC](https://discuss.elastic.co/t/grok-timezone-datetime-parsing-issues/137500 "2018-06-26T19:21:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![alilland](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alilland/32/29729_2.png) [@alilland](https://discuss.elastic.co/u/alilland)\
**Post date:** [June 26, 2018, 7:21pm UTC](https://discuss.elastic.co/t/grok-timezone-datetime-parsing-issues/137500/1 "2018-06-26T19:21:51Z")

</div>

I have logs that are spitting out in the following format:

```
[2018-06-24 07:00:03 -0700] DEBUG - CrewManagement::API - backbone:sync_tokens - {\"description\":\"Sync local tokens with Backbone-Auth - 114\",\"success\":true}

```

I have messed around with the Grok Debugger, and I can extract everything except the `-0700` part. I need to extract the Timestamp and convert it into a UTC date for kibana to see

I'm currently stuck on

`%{TIMESTAMP_ISO8601:event_timestamp} %{DATA:timezone}`

```
# -------- which computes to the following --------
{
  "event_timestamp": [
    ["2018-06-24 07:00:03"]
  ],
  "YEAR": [
    ["2018"]
  ],
  "MONTHNUM": [
    ["06"]
  ],
  "MONTHDAY": [
    ["24"]
  ],
  "HOUR": [
    ["07", null]
  ],
  "MINUTE": [
    ["00", null]
  ],
  "SECOND": [
    ["03"]
  ],
  "ISO8601_TIMEZONE": [
    [null]
  ],
  "timezone": [
    [""]
  ]
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 2, 2018, 7:47pm UTC](https://discuss.elastic.co/t/grok-timezone-datetime-parsing-issues/137500/2 "2018-07-02T19:47:37Z")

</div>

> [@alilland](#):
>
> [2018-06-24 07:00:03 -0700] DEBUG - CrewManagement::API - backbone:sync\_tokens - {"description":"Sync local tokens with Backbone-Auth - 114","success":true}

I would do that using dissect.

```
    dissect { mapping => { "message" => "[%{ts} %{+ts} %{+ts}] %{level} - %{something} - %{somethingElse} - %{restOfLine}" } }
    date { match => ["ts", "yyyy-MM-dd HH:mm:ss Z"] }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 30, 2018, 7:47pm UTC](https://discuss.elastic.co/t/grok-timezone-datetime-parsing-issues/137500/3 "2018-07-30T19:47:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.