Timezone change TZ not working.

[knalla]

Hi,

We are getting logs in UTC format, I tried using TZ=UTC on Heavy forwarder, but its not working for all events.

Working events:
_time Event_Timestamp
2019-07-26 08:25:44.000 2019-07-26T13:24:43.3570000Z
2019-07-26 07:21:45.000 2019-07-26T12:20:42.0070000Z

Not working:
_time Event_Timestamp
2019-07-26 07:04:06.417 2019-07-26T07:04:06.4170000Z
2019-07-26 07:03:06.293 2019-07-26T07:03:06.2930000Z

Any suggestions?

[woodcock · Accepted solution]

Do not set TZ with TZ=, set it with:

TIME_PREFIX = ^\d+\-\d+\-\d+\s+\d+:\d+:\d+\.\d+\s+
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%7N%Z

[richgalloway]

What are your TIME_PREFIX and TIME_FORMAT settings?

[knalla]

nothing, just added TZ=UTC for source type.

[knalla]

Do I need TIME_PREFIX and TIME_FORMAT?

[richgalloway]

You don't need TIME_PREFIX and TIME_FORMAT, but it's a Best Practice to use both.
There's no need for the escape characters in TIME_PREFIX.
TIME_FORMAT should include the time zone indicator. %Y-%m-%dT%H:%M:%S.%7N%Z

[knalla]

Added these in props.conf

TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N
TIME_PREFIX = \"TimeStamp\": \"
TZ = UTC