# Time zone abbr is ambigous which cause @timestamp parsed wrong \[for Postgresql module\]

**URL:** <https://discuss.elastic.co/t/time-zone-abbr-is-ambigous-which-cause-timestamp-parsed-wrong-for-postgresql-module/333863>\
**Category:** Beats\
**Tags:** beats-module, filebeat\
**Created:** [May 19, 2023, 11:12am UTC](https://discuss.elastic.co/t/time-zone-abbr-is-ambigous-which-cause-timestamp-parsed-wrong-for-postgresql-module/333863 "2023-05-19T11:12:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![yanhj93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yanhj93/32/114721_2.png) [@yanhj93](https://discuss.elastic.co/u/yanhj93)\
**Post date:** [May 19, 2023, 11:12am UTC](https://discuss.elastic.co/t/time-zone-abbr-is-ambigous-which-cause-timestamp-parsed-wrong-for-postgresql-module/333863/1 "2023-05-19T11:12:13Z")

</div>

Our postgre server log with timezone CST, in this case it represents China standard time.  
`pipeline`(module provid) will parse the log message and read timezone value use `WORD` pattern, finally date processor parse the time use format `yyyy-MM-dd HH:mm:ss.SSS zz`.  
Eventually time was parse at timezone America/Chicago which not my expect.  
What I have issue with are:

1. pipeline parse timezone use `WORD` pattern this not allow other timezone format.
2. date processor use format `zz` which also reject other options.  
So I wonder if there is any chance to parse my log time right.

```yaml
    filebeat.modules:
    - module: postgresql
      log:
        enabled: true
        var.paths: ["/data/pgdata/pg_log/*.log"]
        input:
          tags: "server"

```

part of pipeline

```json
"grok": {
      "field": "message",
      "patterns": [
        "^%{DATETIME:postgresql.log.timestamp}%{CHAR:separator}%{GREEDYDATA:raw_message}"
      ],
      "pattern_definitions": {
        "DATETIME": "[-0-9]+ %{TIME} %{WORD:event.timezone}",
        "CHAR": ".",
        "GREEDYDATA": "(.|\n|\t)*"
      }
    }
{
    "date": {
      "field": "postgresql.log.timestamp",
      "target_field": "@timestamp",
      "formats": [
        "yyyy-MM-dd HH:mm:ss.SSS zz",
        "yyyy-MM-dd HH:mm:ss zz"
      ]
    }
  }

```

Version: 7.14

---

<div class="post-metadata">

**Author:** ![Wave](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wave/32/117242_2.png) [@Wave](https://discuss.elastic.co/u/Wave)\
**Post date:** [May 24, 2023, 2:33pm UTC](https://discuss.elastic.co/t/time-zone-abbr-is-ambigous-which-cause-timestamp-parsed-wrong-for-postgresql-module/333863/2 "2023-05-24T14:33:13Z")

</div>

Hi @yanhj93,

Can we see an example of the data values in question? You might already know this but the lower case "z" options can't be parsed according to the [documentation](https://www.elastic.co/guide/en/logstash/7.14/plugins-filters-date.html#plugins-filters-date-match). Having said that we should be able to parse the data but having the input would help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 21, 2023, 4:33pm UTC](https://discuss.elastic.co/t/time-zone-abbr-is-ambigous-which-cause-timestamp-parsed-wrong-for-postgresql-module/333863/3 "2023-06-21T16:33:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.