# Timezone offset problem

**URL:** <https://discuss.elastic.co/t/timezone-offset-problem/44845>\
**Category:** Logstash\
**Created:** [March 18, 2016, 2:20pm UTC](https://discuss.elastic.co/t/timezone-offset-problem/44845 "2016-03-18T14:20:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![DaveO](https://avatars.discourse-cdn.com/v4/letter/d/b487fb/32.png) [@DaveO](https://discuss.elastic.co/u/DaveO)\
**Post date:** [March 18, 2016, 2:20pm UTC](https://discuss.elastic.co/t/timezone-offset-problem/44845/1 "2016-03-18T14:20:03Z")

</div>

I'm having problems setting @timestamp based on the date, time and time zone offset fields from System Center Configuration Manager client logs.

After much trial and error, I have narrowed down the problem to the time zone offset value in the log only having 3 digits instead of 4 (+300 fails, +0300 works)

This is the date filter I'm using for testing:  
date { match =\> ["message", "MM-dd-yyyy HH:mm:ss.SSSZ"] }

Here are the lines I'm sending to logstash:  
"01-02-2016 01:02:03.456+300"  
"01-02-2016 01:02:03.456+0300"

The first one fails with a dateparsefailure, the second one succeeds. Unfortunately, the offsets in the log are all 3-digits instead of 4.

Any suggestions how to handle this case? I did quite a bit of searching and couldn't find a way to format or pad the offset. I considered dropping it altogether, but that would make it harder to correlate with data from other sources.

Dave

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 18, 2016, 2:27pm UTC](https://discuss.elastic.co/t/timezone-offset-problem/44845/2 "2016-03-18T14:27:15Z")

</div>

Perhaps use the mutate filter's gsub option to insert a leading zero if it's missing? I don't recall if gsub support backreferences, but otherwise you can definitely do it with a grok filter.

---

<div class="post-metadata">

**Author:** ![DaveO](https://avatars.discourse-cdn.com/v4/letter/d/b487fb/32.png) [@DaveO](https://discuss.elastic.co/u/DaveO)\
**Post date:** [March 18, 2016, 5:29pm UTC](https://discuss.elastic.co/t/timezone-offset-problem/44845/3 "2016-03-18T17:29:18Z")

</div>

Magnus, thanks for taking a look.

I was unable to get any traction with either gsub or grok, but succeeded with the following ruby code filter:

```
  ruby {
     code => " event['timezone'] = '%+05d' % event['timezone'] "
}

```

That reformats the timezone offset from +300 to +0300 which makes the date filter happy.

I'm still a newbie, so this may not be the best approach, but it works.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:06am UTC](https://discuss.elastic.co/t/timezone-offset-problem/44845/4 "2017-07-06T05:06:25Z")

</div>