Time zone abbr is ambigous which cause @timestamp parsed wrong [for Postgresql module]

Elastic Stack Beats
,
1

Our postgre server log with timezone CST, in this case it represents China standard time.
pipeline(module provid) will parse the log message and read timezone value use WORD pattern, finally date processor parse the time use format yyyy-MM-dd HH:mm:ss.SSS zz.
Eventually time was parse at timezone America/Chicago which not my expect.
What I have issue with are:

  1. pipeline parse timezone use WORD pattern this not allow other timezone format.
  2. date processor use format zz which also reject other options.
    So I wonder if there is any chance to parse my log time right.
    filebeat.modules:
    - module: postgresql
      log:
        enabled: true
        var.paths: ["/data/pgdata/pg_log/*.log"]
        input:
          tags: "server"

part of pipeline

"grok": {
      "field": "message",
      "patterns": [
        "^%{DATETIME:postgresql.log.timestamp}%{CHAR:separator}%{GREEDYDATA:raw_message}"
      ],
      "pattern_definitions": {
        "DATETIME": "[-0-9]+ %{TIME} %{WORD:event.timezone}",
        "CHAR": ".",
        "GREEDYDATA": "(.|\n|\t)*"
      }
    }
{
    "date": {
      "field": "postgresql.log.timestamp",
      "target_field": "@timestamp",
      "formats": [
        "yyyy-MM-dd HH:mm:ss.SSS zz",
        "yyyy-MM-dd HH:mm:ss zz"
      ]
    }
  }

Version: 7.14

2

Hi @yanhj93,

Can we see an example of the data values in question? You might already know this but the lower case "z" options can't be parsed according to the documentation. Having said that we should be able to parse the data but having the input would help.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.