# "Verbose" timezone

**URL:** <https://discuss.elastic.co/t/verbose-timezone/83103>\
**Category:** Logstash\
**Created:** [April 20, 2017, 6:45pm UTC](https://discuss.elastic.co/t/verbose-timezone/83103 "2017-04-20T18:45:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![gtorrance](https://avatars.discourse-cdn.com/v4/letter/g/8edcca/32.png) [@gtorrance](https://discuss.elastic.co/u/gtorrance)\
**Post date:** [April 20, 2017, 6:45pm UTC](https://discuss.elastic.co/t/verbose-timezone/83103/1 "2017-04-20T18:45:23Z")

</div>

Hi all,

I'm trying to create a grok statement for an httpd "access" log with entries like the following:

```
127.0.0.1 - - 2017-04-20 02:15:42.369 Pacific Daylight Time 80 "HEAD /favicon.ico HTTP/1.1" "-" 200 - "-" 1004 WPh8Pgrmjx8AACx4h8oAAABl

```

The problem I'm running into is that I don't know how to parse the very verbose "Pacific Daylight Time" (and presumably all the other possible timezone descriptions) and ensure that they are correctly stored by grok when doing a date-match such as this:

> ```
> date {
> match => ["eventTimeStr", "YYYY-MM-dd HH:mm:ss.SSS Z"]
> }
> 
> ```

At this point I don't know if changing the log format to use a numeric timezone is an option. But that might be outside of my control, so I'd prefer to come up with a solution that does not require changing the logs.

Thoughts?

Thanks much,  
Greg

---

<div class="post-metadata">

**Author:** ![gtorrance](https://avatars.discourse-cdn.com/v4/letter/g/8edcca/32.png) [@gtorrance](https://discuss.elastic.co/u/gtorrance)\
**Post date:** [April 20, 2017, 7:18pm UTC](https://discuss.elastic.co/t/verbose-timezone/83103/2 "2017-04-20T19:18:51Z")

</div>

So it appears what I want to do is not possible...

[https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html)

```
z time zone names. Time zone names (z) cannot be parsed.

```

If I'm misunderstanding, please let me know. (Seems changing the logs may be the only option.)

Thanks,  
Greg

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 21, 2017, 6:12am UTC](https://discuss.elastic.co/t/verbose-timezone/83103/3 "2017-04-21T06:12:10Z")

</div>

Apart from changing the log format (which I think you should pursue on general principle since it's completely idiotic and not even convenient for humans) you can use a translate filter to transform the verbose timezone string names into UTC offsets. I'm guessing you have a finite set of timezone names appearing in your logs.

---

<div class="post-metadata">

**Author:** ![gtorrance](https://avatars.discourse-cdn.com/v4/letter/g/8edcca/32.png) [@gtorrance](https://discuss.elastic.co/u/gtorrance)\
**Post date:** [April 21, 2017, 1:38pm UTC](https://discuss.elastic.co/t/verbose-timezone/83103/4 "2017-04-21T13:38:41Z")

</div>

Thanks for the suggestion, Magnus. I'll definitely look into the translate filter. (And, yes, I share your thoughts about the 'idiotic' logging choice.)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 19, 2017, 1:48pm UTC](https://discuss.elastic.co/t/verbose-timezone/83103/5 "2017-05-19T13:48:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.