# Ingest Node Timezone Offset

**URL:** <https://discuss.elastic.co/t/ingest-node-timezone-offset/236006>\
**Category:** Elasticsearch\
**Created:** [June 5, 2020, 8:15pm UTC](https://discuss.elastic.co/t/ingest-node-timezone-offset/236006 "2020-06-05T20:15:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![crux](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/crux/32/21918_2.png) [@crux](https://discuss.elastic.co/u/crux)\
**Post date:** [June 5, 2020, 8:15pm UTC](https://discuss.elastic.co/t/ingest-node-timezone-offset/236006/1 "2020-06-05T20:15:34Z")

</div>

I've found an inconsistency between Logstash date matching syntax and Ingest node date matching syntax. I have a time field that looks like this:

```auto
2020-06-03 15:37:14.465 -04:00

```

While most of the [Logstash Date Plugin](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-match) syntax applies to the [Ingest Node Date Processor](https://www.elastic.co/guide/en/elasticsearch/reference/master/date-processor.html), it doesn't look like the time zone syntax is the same. Based on the time zone match conditions, this match expression should work for the value above: `yyyy-MM-dd HH:mm:ss.SSS ZZ`. However, a processor with this match condition will fail with an `illegal_argument_exception`. The Logstash documentation clearly defines the time zone field:

> ZZ  
> Timezone offset structured as HH:mm (colon in between hour and minute offsets). Example: `-07:00`.
> 
> z  
> time zone names. **Time zone names ( _z_ ) cannot be parsed.**

But the only match condition that works is `yyyy-MM-dd HH:mm:ss.SSS z`. `z` should match time zone names, not offsets structured the way it's documented. Here's a simulation of it successfully executing:

Request

```json
POST /_ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "date": {
          "field": "timestamp",
          "formats": ["yyyy-MM-dd HH:mm:ss.SSS z"]
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "timestamp": "2020-06-03 15:37:14.465 -04:00"
      }
    }
  ]
}

```

Response

```json
{
  "docs" : [
    {
      "doc" : {
        "_index" : "_index",
        "_type" : "_doc",
        "_id" : "_id",
        "_source" : {
          "@timestamp" : "2020-06-03T19:37:14.465Z",
          "timestamp" : "2020-06-03 15:37:14.465 -04:00"
        },
        "_ingest" : {
          "timestamp" : "2020-06-05T20:11:29.730182Z"
        }
      }
    }
  ]
}

```

Is this a bug or is this expected behavior that didn't get documented?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 3, 2020, 8:15pm UTC](https://discuss.elastic.co/t/ingest-node-timezone-offset/236006/2 "2020-07-03T20:15:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.