Grok patterN for timestamp with timezone

Solution 1:

You can define a custom pattern that extends SYSLOGTIMESTAMP.

    grok {
        pattern_definitions => { "TIMESTAMPWITHTZ" => "%{SYSLOGTIMESTAMP}[-+]\d{2}:\d{2}" }
        match => { "message" => "%{TIMESTAMPWITHTZ:[@metadata][timestamp]}" }
    }
    date { match => [ "[@metadata][timestamp]", "MMM dd HH:mm:ssZZ", "MMM  d HH:mm:ssZZ" ] }

Note that syslog timestamps do not include the year. logstash has heuristics to work around this (e.g. if the current date is in January and the log entry is from December then assume it is from the prior year). The heuristics are not perfect and sometimes will assign the wrong year.