diff --git a/patterns/grok-patterns b/patterns/grok-patterns index 37c70487..63dead12 100755 --- a/patterns/grok-patterns +++ b/patterns/grok-patterns @@ -68,7 +68,7 @@ ISO8601_SECOND (?:%{SECOND}|60) TIMESTAMP_ISO8601 %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}? DATE %{DATE_US}|%{DATE_EU} DATESTAMP %{DATE}[- ]%{TIME} -TZ (?:[PMCE][SD]T|UTC) +TZ (?:[PMCE][SD]T|UTC|CEST|CET) DATESTAMP_RFC822 %{DAY} %{MONTH} %{MONTHDAY} %{YEAR} %{TIME} %{TZ} DATESTAMP_RFC2822 %{DAY}, %{MONTHDAY} %{MONTH} %{YEAR} %{TIME} %{ISO8601_TIMEZONE} DATESTAMP_OTHER %{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{TZ} %{YEAR} diff --git a/spec/patterns/core_spec.rb b/spec/patterns/core_spec.rb index b85f6e09..e94f9e4e 100644 --- a/spec/patterns/core_spec.rb +++ b/spec/patterns/core_spec.rb @@ -3,4 +3,23 @@ require 'logstash/patterns/core' describe LogStash::Patterns::Core do + describe "Dates with time zone are correctly interpreted" do + config <<-CONFIG + filter { + grok { + match => [ "message", "%{DATESTAMP_RFC822:stimestamp}" ] + singles => true + } + } + CONFIG + sample "Tue Jan 01 2013 04:51:39 CEST" do + insist { subject["stimestamp"] }== "Tue Jan 01 2013 04:51:39 CEST" + end + sample "Tue Jan 01 2013 04:51:39 CET" do + insist { subject["stimestamp"] }== "Tue Jan 01 2013 04:51:39 CET" + end + sample "Tue Jan 01 2013 04:51:39 UTC" do + insist { subject["stimestamp"] }== "Tue Jan 01 2013 04:51:39 UTC" + end + end end