# Rewrite the timezone of a message

Starting with version 3.24 of the AxoSyslog application, you can manipulate the timezone information of messages using rewrite rules. You can:

  * [Set a timezone](../../../docs/axosyslog-core/4.26/chapter-manipulating-messages/modifying-messages/rewrite-timezone/index.md#rewrite-timezone-set) to a specific value
  * [Fix a timezone](../../../docs/axosyslog-core/4.26/chapter-manipulating-messages/modifying-messages/rewrite-timezone/index.md#rewrite-timezone-fix) if it was improperly parsed
  * Assuming the sender is sending messages in near-real-time, AxoSyslog can [guess the timezone](../../../docs/axosyslog-core/4.26/chapter-manipulating-messages/modifying-messages/rewrite-timezone/index.md#rewrite-timezone-guess)



By default, these operations modify the date-related macros of the message that correspond to the date the message was sent (that is, the `S_` macros). You can modify the dates when AxoSyslog has received the messages (that is, the R_ macros), but this is rarely needed. To do so, include the `time-stamp(recvd)` option in the operation, for example:

Terminal window
```
       rewrite { fix-time-zone("EST5EDT" time-stamp(recvd)); };
```

If you’re using FilterX, see also the equivalent [`set_timezone()`](../../../docs/axosyslog-core/4.26/filterx/filterx-timezone/index.md#set-timezone) function.

## fix-time-zone()

Use the `fix-time-zone()` operation to correct the timezone of a message if it was parsed incorrectly for some reason, or if the client did not include any timezone information in the message. You can specify the new timezone as the name of a timezone, or as a template string. For example, use the following rewrite rule to set the timezone to EST5EDT:

Terminal window
```
       rewrite { fix-time-zone("EST5EDT"); };
```

If you have lots of clients that do not send timezone information in the log messages, you can create a database file that stores the timezone of the clients, and feed this data to AxoSyslog using the `add-contextual-data()` feature. For details, see [Adding metadata from an external file](../../../docs/axosyslog-core/4.26/chapter-enrich-data/data-enrichment-add-contextual-data/index.md).

See also the equivalent FilterX function, [`fix_timezone()`](../../../docs/axosyslog-core/4.26/filterx/filterx-timezone/index.md#fix-timezone).

## guess-time-zone()

Use the `guess-time-zone()` operation attempts to set the timezone of the message automatically, using heuristics on the timestamps. Normally the AxoSyslog application performs this operation automatically when it parses the incoming message. Using this operation in a rewrite rule can be useful if you cannot parse the incoming message for some reason (and use the `flags(no-parse)` option in your source, but you want to set the timezone automatically later (for example, after you have preprocessed the message).

Using this operation is identical to using the `flags(guess-timezone)` flag in the source.

See also the equivalent FilterX function, [`guess_timezone()`](../../../docs/axosyslog-core/4.26/filterx/filterx-timezone/index.md#guess-timezone).

## set-time-zone()

Use the `set-time-zone()` operation to set the timezone of the message to a specific value, that is to convert an existing timezone to a different one. This operation is identical to setting the `time-zone()` option in a destination or as a global option, but can be applied selectively to the messages using conditions.

## Options

The `fix-time-zone()`, `guess-time-zone()`, and `set-time-zone()` rewrite rules have the following options.

## condition()

|   
---|---  
Type: | filter expression  
Default: | N/A  
  
_Description:_ Applies the rewrite rule only to the messages that match the specified filter expression. Messages that don’t match the filter pass through the rule unmodified, and continue to the next element of the log path. You can use any filter expression here, and you can reference an existing filter with the `filter()` function. For details, see [Conditional rewrites](../../../docs/axosyslog-core/4.26/chapter-manipulating-messages/modifying-messages/conditional-rewrite/index.md).

## time-stamp()

|   
---|---  
Type: | `stamp`, `recvd`  
Default: | `stamp`  
  
_Description:_ Selects the timestamp that the rule modifies. With `time-stamp(stamp)`, the rule changes the date the message was sent, that is, the `S_` macros. With `time-stamp(recvd)`, it changes the date AxoSyslog received the message, that is, the `R_` macros.

Last modified August 10, 2026: [Sync rewrite rule options with the source (d33662b7)](<https://github.com/axoflow/axosyslog-core-docs/commit/d33662b7e6212a930666d724aa0ba2f88d4ba4ae>)