# Postgresql timezone and error message provided grok expressions do not match field value

**URL:** <https://discuss.elastic.co/t/postgresql-timezone-and-error-message-provided-grok-expressions-do-not-match-field-value/381946>\
**Category:** Elasticsearch\
**Created:** [September 15, 2025, 9:39am UTC](https://discuss.elastic.co/t/postgresql-timezone-and-error-message-provided-grok-expressions-do-not-match-field-value/381946 "2025-09-15T09:39:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![VillsEK](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/villsek/32/145033_2.png) [@VillsEK](https://discuss.elastic.co/u/VillsEK)\
**Post date:** [September 15, 2025, 9:39am UTC](https://discuss.elastic.co/t/postgresql-timezone-and-error-message-provided-grok-expressions-do-not-match-field-value/381946/1 "2025-09-15T09:39:49Z")

</div>

Helloy there, im new in elk.  
can someone tell me how to fix the error "error message provided grok expressions do not match field value". I found out that when the time zone is specified as an abbreviation in the postgres logs, there is no error log, example:

```auto
2025-09-12 13:30:24.962 MSK [11423] LOG: database system is ready to accept connections
2025-09-12 13:30:24.965 MSK [11458] LOG: TimescaleDB background worker launcher connected to shared catalogs

```

but when the time zone is specified in numbers, it gives an error, for example

```auto
2025-09-12 12:20:38.985 +05 [22657] zabbix@zabbix_proxy LOG: duration: 1.102 ms statement: commit;
2025-09-12 12:20:38.985 +05 [22657] zabbix@zabbix_proxy LOG: duration: 0.123 ms statement: begin;

```

how fix it?

I don't know how to change grok to make it work. i use postgresql 13. filebeat-9.1.3

---

<div class="post-metadata">

**Author:** ![VillsEK](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/villsek/32/145033_2.png) [@VillsEK](https://discuss.elastic.co/u/VillsEK)\
**Post date:** [September 15, 2025, 5:03pm UTC](https://discuss.elastic.co/t/postgresql-timezone-and-error-message-provided-grok-expressions-do-not-match-field-value/381946/2 "2025-09-15T17:03:02Z")

</div>

I solved the problem with the time zone, but not completely, now it gives a parsing error  
e **rror.message**

Text '2025-09-15 21:59:25.803 +05' could not be parsed at index 24