I have a message with timestamp without specified timezone in it, but timezone actually -6 CST. It is not UTC.
“2017/12/30 15:19:57 [error] 27739#0: *3722503 limiting requests, excess: 0.062 by zone “wp-login”, client: 10.189.252.6, server: blog.com, request: “POST /ame/wp-login.php HTTP/1.1”, host: “www.ame.com””
With following GROK pattern:
Is there a way to specify at time parsing tell that timestamp in message should be stored as -6 CST timestamp, not UTC. Because i see:
Sat Dec 30 15:19:57 UTC 2017
But it is actually not UTC timezone, but CST -6.