Substring not returning consistent result

[Laxmi_Barthwal (lakshmi barthwal)]

When using scripted fields to extract date from _source field ( log.keyword) , then getting date as january1 1970 in some case and in some case getting correct date.

My script is
for test2 : returns Date
if (doc['log.keyword'].value != null)
return doc['log.keyword'].value.substring(0, doc['log.keyword'].value.indexOf('Z')+1) ;
else
-1

for LogDateTest: returns date
if (doc['log.keyword'].value != null) return doc['log.keyword'].value.substring(0, doc['log.keyword'].value.indexOf('T')); else return -1;

Place where its giving correct result

Place where its giving wrong result

Can anyone explain why is this so and how to get the date and time in all the cases.