# How to rectify wrong UTC offset value

**URL:** <https://discuss.elastic.co/t/how-to-rectify-wrong-utc-offset-value/213331>\
**Category:** Logstash\
**Created:** [December 30, 2019, 10:58am UTC](https://discuss.elastic.co/t/how-to-rectify-wrong-utc-offset-value/213331 "2019-12-30T10:58:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ruranga](https://avatars.discourse-cdn.com/v4/letter/r/97f17d/32.png) [@ruranga](https://discuss.elastic.co/u/ruranga)\
**Post date:** [December 30, 2019, 10:58am UTC](https://discuss.elastic.co/t/how-to-rectify-wrong-utc-offset-value/213331/1 "2019-12-30T10:58:13Z")

</div>

Hi,  
I sending my Symantec proxy (Bluecoat) logs to ELK stack. The date formats is as follows  
"[dd/MMM/YYYY:HH:mm:ss Z]"  
"[30/Dec/2019:15:34:11 **+0550**]"

Unfortunately due to a bug in current SGOS (proxy firmware) version Proxy logs sends the +0550 as the UTC offset which is wrong for my timezone. I'm from Sri Lanka (Asia) and UTC offset should be +0530. Is there a way that I can rectify this 20 minutes error in logstash?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 30, 2019, 2:43pm UTC](https://discuss.elastic.co/t/how-to-rectify-wrong-utc-offset-value/213331/2 "2019-12-30T14:43:24Z")

</div>

Use mutate+gsub to change it?

---

<div class="post-metadata">

**Author:** ![ruranga](https://avatars.discourse-cdn.com/v4/letter/r/97f17d/32.png) [@ruranga](https://discuss.elastic.co/u/ruranga)\
**Post date:** [January 1, 2020, 1:21am UTC](https://discuss.elastic.co/t/how-to-rectify-wrong-utc-offset-value/213331/3 "2020-01-01T01:21:25Z")

</div>

Hi,  
I have done with mutate+gsub. ut it seems like after the replacement that particular parameter ("localtime") doesn't detects as a parameter in date format. Is there a workaround that I can perform. Below is my logstash,conf

input {  
beats {  
type =\> "proxy\_bluecoat"  
port =\> 5044  
}  
}

filter {  
if [type] == "proxy\_bluecoat" {  
# drop comment lines  
if ([message] =~ /^#/) {  
drop{}  
}  
csv {  
columns =\> ["para1","para2", "para3", "para4", "localtime", "time\_taken", "c\_ip", "cs\_username", "cs\_auth\_group", "x\_exception\_id", "sc\_filter\_result", "cs\_categories", "cs\_referer", "sc\_status", "s\_action", "cs\_method", "rs\_content\_type", "cs\_uri\_scheme", "cs\_host", "cs\_uri\_port", "cs\_uri\_path", "cs\_uri\_query", "cs\_uri\_extension", "cs\_user\_agent", "s\_ip", "sc\_bytes", "cs\_bytes", "x\_virus\_id", "x\_bluecoat\_application\_name", "x\_bluecoat\_application\_operation", "x\_bluecoat\_application\_groups", "cs\_threat\_risk", "r\_ip"]  
separator =\> " "  
}

```
mutate {
    gsub => [
      "localtime", "0550", "0530",
    ]
  }

if [localtime] {
  date {
       match => ["localtime", "[dd/MMM/YYYY:HH:mm:ss Z]"]
  }
}

if ([r-ip] and [r-ip] != "-") {
  geoip {
    source => "r-ip"
  }
}

mutate {
  convert => ["sc_bytes", "integer",
              "time_taken", "integer",
              "r_port", "integer",
              "s_port", "integer",
              "cs_bytes", "integer",
              "duration", "integer",
              "cs_threat_risk", "integer"
              ]
}

if [cs_user_agent] != "" {
  useragent { source => "cs_user_agent" prefix => "user_agent." }
}

if ([cs_categories] and [cs_categories] != "" and [cs_categories] != "-") {
    mutate {
        split => { "cs_categories" => ";" }
    }
}

mutate {
  remove_field => ["message", "host", "date", "time", "timestamp", "gmttime", "para1", "para2", "para3", "para4"]
}

```

}  
}

output {  
if [type] == "proxy\_bluecoat" {  
#stdout { codec =\> rubydebug }  
elasticsearch {  
index =\> "syslogs-%{[type]}-%{+YYYY.MM.dd}"  
hosts =\> ["elasticsearch:9200"]  
#index =\> "logstash-%{[type]}-%{+YYYY.MM.dd}"  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 1, 2020, 2:21am UTC](https://discuss.elastic.co/t/how-to-rectify-wrong-utc-offset-value/213331/4 "2020-01-01T02:21:14Z")

</div>

> [@ruranga](#):
>
> date { match =\> ["localtime", "[dd/MMM/YYYY:HH:mm:ss Z]"] }

By default, the date filter will modify [@timestamp]. If you want to overwrite [localtime] then you have to set the target option on the date fitler.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 29, 2020, 2:29am UTC](https://discuss.elastic.co/t/how-to-rectify-wrong-utc-offset-value/213331/5 "2020-01-29T02:29:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.