From 8a1ce205621d4141598d4b2562dde0f97fc4b3e0 Mon Sep 17 00:00:00 2001
From: Rock-HOG <10247631+Rock-HOG@users.noreply.github.com>
Date: Tue, 29 May 2018 11:08:13 -0700
Subject: [PATCH] adds lowercase to TZ pattern

some log entries may show lowercase timezone.
---
 patterns/grok-patterns | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/patterns/grok-patterns b/patterns/grok-patterns
index 3e4539b8..875eb574 100644
--- a/patterns/grok-patterns
+++ b/patterns/grok-patterns
@@ -71,7 +71,7 @@ ISO8601_SECOND (?:%{SECOND}|60)
 TIMESTAMP_ISO8601 %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?
 DATE %{DATE_US}|%{DATE_EU}
 DATESTAMP %{DATE}[- ]%{TIME}
-TZ (?:[APMCE][SD]T|UTC)
+TZ (?:[AaPpMmCcEe][SsDd][Tt]|UTC|utc)
 DATESTAMP_RFC822 %{DAY} %{MONTH} %{MONTHDAY} %{YEAR} %{TIME} %{TZ}
 DATESTAMP_RFC2822 %{DAY}, %{MONTHDAY} %{MONTH} %{YEAR} %{TIME} %{ISO8601_TIMEZONE}
 DATESTAMP_OTHER %{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{TZ} %{YEAR}