From d347e8a9c1eae0856d275df91f09adc93b512ce3 Mon Sep 17 00:00:00 2001 From: Damien GOUYETTE Date: Thu, 15 May 2014 06:23:42 +0200 Subject: [PATCH 1/2] add CEST and CET timezone to TZ #1321 --- logstash-patterns-core.gemspec | 1 + patterns/grok-patterns | 2 +- spec/patterns/core_spec.rb | 19 +++++++++++++++++++ 3 files changed, 21 insertions(+), 1 deletion(-) diff --git a/logstash-patterns-core.gemspec b/logstash-patterns-core.gemspec index 0c8e3da5..c2c936b2 100644 --- a/logstash-patterns-core.gemspec +++ b/logstash-patterns-core.gemspec @@ -23,5 +23,6 @@ Gem::Specification.new do |s| s.add_runtime_dependency "logstash-core", '>= 1.4.0', '< 2.0.0' s.add_development_dependency 'logstash-devutils' + s.add_development_dependency 'logstash-filter-grok' end diff --git a/patterns/grok-patterns b/patterns/grok-patterns index 37c70487..63dead12 100755 --- a/patterns/grok-patterns +++ b/patterns/grok-patterns @@ -68,7 +68,7 @@ ISO8601_SECOND (?:%{SECOND}|60) TIMESTAMP_ISO8601 %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}? DATE %{DATE_US}|%{DATE_EU} DATESTAMP %{DATE}[- ]%{TIME} -TZ (?:[PMCE][SD]T|UTC) +TZ (?:[PMCE][SD]T|UTC|CEST|CET) DATESTAMP_RFC822 %{DAY} %{MONTH} %{MONTHDAY} %{YEAR} %{TIME} %{TZ} DATESTAMP_RFC2822 %{DAY}, %{MONTHDAY} %{MONTH} %{YEAR} %{TIME} %{ISO8601_TIMEZONE} DATESTAMP_OTHER %{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{TZ} %{YEAR} diff --git a/spec/patterns/core_spec.rb b/spec/patterns/core_spec.rb index b85f6e09..e94f9e4e 100644 --- a/spec/patterns/core_spec.rb +++ b/spec/patterns/core_spec.rb @@ -3,4 +3,23 @@ require 'logstash/patterns/core' describe LogStash::Patterns::Core do + describe "Dates with time zone are correctly interpreted" do + config <<-CONFIG + filter { + grok { + match => [ "message", "%{DATESTAMP_RFC822:stimestamp}" ] + singles => true + } + } + CONFIG + sample "Tue Jan 01 2013 04:51:39 CEST" do + insist { subject["stimestamp"] }== "Tue Jan 01 2013 04:51:39 CEST" + end + sample "Tue Jan 01 2013 04:51:39 CET" do + insist { subject["stimestamp"] }== "Tue Jan 01 2013 04:51:39 CET" + end + sample "Tue Jan 01 2013 04:51:39 UTC" do + insist { subject["stimestamp"] }== "Tue Jan 01 2013 04:51:39 UTC" + end + end end From d317ff4d60397f953c18427b0b2e22cbb53f20ae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jo=C3=A3o=20Duarte?= Date: Wed, 17 Apr 2019 09:50:28 +0100 Subject: [PATCH 2/2] Update logstash-patterns-core.gemspec --- logstash-patterns-core.gemspec | 1 - 1 file changed, 1 deletion(-) diff --git a/logstash-patterns-core.gemspec b/logstash-patterns-core.gemspec index c2c936b2..0c8e3da5 100644 --- a/logstash-patterns-core.gemspec +++ b/logstash-patterns-core.gemspec @@ -23,6 +23,5 @@ Gem::Specification.new do |s| s.add_runtime_dependency "logstash-core", '>= 1.4.0', '< 2.0.0' s.add_development_dependency 'logstash-devutils' - s.add_development_dependency 'logstash-filter-grok' end