From b4592c171ad025ecbfd41dd76fad760b52919290 Mon Sep 17 00:00:00 2001
From: braydonk <braydonk@google.com>
Date: Sat, 28 Oct 2023 15:49:37 +0000
Subject: [PATCH] parser: add Time_System_Timezone

Signed-off-by: braydonk <braydonk@google.com>
---
 include/fluent-bit/flb_parser.h               |  11 +-
 .../in_kubernetes_events/kubernetes_events.c  |   2 +-
 src/flb_parser.c                              |  25 ++-
 src/flb_parser_json.c                         |   2 +-
 src/flb_parser_logfmt.c                       |   2 +-
 src/flb_parser_ltsv.c                         |   2 +-
 src/flb_parser_regex.c                        |   2 +-
 src/multiline/flb_ml_parser_cri.c             |   1 +
 src/multiline/flb_ml_parser_docker.c          |   1 +
 tests/internal/fuzzers/engine_fuzzer.c        |   2 +-
 tests/internal/fuzzers/parse_json_fuzzer.c    |   2 +-
 tests/internal/fuzzers/parse_logfmt_fuzzer.c  |   4 +-
 tests/internal/fuzzers/parse_ltsv_fuzzer.c    |   4 +-
 tests/internal/fuzzers/parser_fuzzer.c        |   2 +-
 tests/internal/parser.c                       |   2 +-
 tests/internal/parser_json.c                  |  12 +-
 tests/internal/parser_logfmt.c                |   8 +-
 tests/internal/parser_ltsv.c                  |  10 +-
 tests/internal/parser_regex.c                 |  10 +-
 tests/runtime/filter_parser.c                 | 149 ++++++++++++++++--
 20 files changed, 205 insertions(+), 48 deletions(-)

diff --git a/include/fluent-bit/flb_parser.h b/include/fluent-bit/flb_parser.h
index 4f136b9a5c1..0810ed000d3 100644
--- a/include/fluent-bit/flb_parser.h
+++ b/include/fluent-bit/flb_parser.h
@@ -48,6 +48,7 @@ struct flb_parser {
     char *time_fmt_full;  /* original given time format */
     char *time_key;       /* field name that contains the time */
     int time_offset;      /* fixed UTC offset */
+    int time_system_timezone; /* use the system timezone as a fallback */
     int time_keep;        /* keep time field */
     int time_strict;      /* parse time field strictly */
     int logfmt_no_bare_keys; /* in logfmt parsers, require all keys to have values */
@@ -74,13 +75,18 @@ enum {
     FLB_PARSER_TYPE_HEX,
 };
 
-static inline time_t flb_parser_tm2time(const struct flb_tm *src)
+static inline time_t flb_parser_tm2time(const struct flb_tm *src, 
+                                        int use_system_timezone)
 {
     struct tm tmp;
     time_t res;
 
     tmp = src->tm;
-    res = timegm(&tmp) - flb_tm_gmtoff(src);
+    if (use_system_timezone) {
+        res = mktime(&tmp);
+    } else {
+        res = timegm(&tmp) - flb_tm_gmtoff(src);
+    }
     return res;
 }
 
@@ -92,6 +98,7 @@ struct flb_parser *flb_parser_create(const char *name, const char *format,
                                      const char *time_offset,
                                      int time_keep,
                                      int time_strict,
+                                     int time_system_timezone,
                                      int logfmt_no_bare_keys,
                                      struct flb_parser_types *types,
                                      int types_len,
diff --git a/plugins/in_kubernetes_events/kubernetes_events.c b/plugins/in_kubernetes_events/kubernetes_events.c
index 6231becb0ad..40bf5c90acd 100644
--- a/plugins/in_kubernetes_events/kubernetes_events.c
+++ b/plugins/in_kubernetes_events/kubernetes_events.c
@@ -225,7 +225,7 @@ static int record_get_field_time(msgpack_object *obj, const char *fieldname, str
         return -2;
     }
 
-    val->tm.tv_sec = flb_parser_tm2time(&tm);
+    val->tm.tv_sec = flb_parser_tm2time(&tm, FLB_FALSE);
     val->tm.tv_nsec = 0;
 
     return 0;
diff --git a/src/flb_parser.c b/src/flb_parser.c
index dc78f076fda..8df7f56dfb5 100644
--- a/src/flb_parser.c
+++ b/src/flb_parser.c
@@ -152,6 +152,7 @@ struct flb_parser *flb_parser_create(const char *name, const char *format,
                                      const char *time_offset,
                                      int time_keep,
                                      int time_strict,
+                                     int time_system_timezone,
                                      int logfmt_no_bare_keys,
                                      struct flb_parser_types *types,
                                      int types_len,
@@ -312,8 +313,17 @@ struct flb_parser *flb_parser_create(const char *name, const char *format,
             p->time_frac_secs = (tmp + 2);
         }
 
-        /* Optional fixed timezone offset */
-        if (time_offset) {
+        /* 
+         * Fall back to the system timezone 
+         * if there is no zone parsed from the log.  
+         */
+        p->time_system_timezone = time_system_timezone;
+
+        /* 
+         * Optional fixed timezone offset, only applied if 
+         * not falling back to system timezone. 
+         */
+        if (!p->time_system_timezone && time_offset) {
             diff = 0;
             len = strlen(time_offset);
             ret = flb_parser_tzone_offset(time_offset, len, &diff);
@@ -487,6 +497,7 @@ static int parser_conf_file(const char *cfg, struct flb_cf *cf,
     int skip_empty;
     int time_keep;
     int time_strict;
+    int time_system_timezone;
     int logfmt_no_bare_keys;
     int types_len;
     struct mk_list *head;
@@ -561,6 +572,13 @@ static int parser_conf_file(const char *cfg, struct flb_cf *cf,
             flb_sds_destroy(tmp_str);
         }
 
+        time_system_timezone = FLB_FALSE;
+        tmp_str = get_parser_key(config, cf, s, "time_system_timezone");
+        if (tmp_str) {
+            time_system_timezone = flb_utils_bool(tmp_str);
+            flb_sds_destroy(tmp_str);
+        }
+
         /* time_offset (UTC offset) */
         time_offset = get_parser_key(config, cf, s, "time_offset");
 
@@ -587,7 +605,8 @@ static int parser_conf_file(const char *cfg, struct flb_cf *cf,
         /* Create the parser context */
         if (!flb_parser_create(name, format, regex, skip_empty,
                                time_fmt, time_key, time_offset, time_keep, time_strict,
-                               logfmt_no_bare_keys, types, types_len, decoders, config)) {
+                               time_system_timezone, logfmt_no_bare_keys, types, types_len, 
+                               decoders, config)) {
             goto fconf_error;
         }
 
diff --git a/src/flb_parser_json.c b/src/flb_parser_json.c
index d8552cd7233..1693f766606 100644
--- a/src/flb_parser_json.c
+++ b/src/flb_parser_json.c
@@ -207,7 +207,7 @@ int flb_parser_json_do(struct flb_parser *parser,
         skip = map_size;
     }
     else {
-        time_lookup = flb_parser_tm2time(&tm);
+        time_lookup = flb_parser_tm2time(&tm, parser->time_system_timezone);
     }
 
     /* Compose a new map without the time_key field */
diff --git a/src/flb_parser_logfmt.c b/src/flb_parser_logfmt.c
index 6d88cd6a0e7..12de008230a 100644
--- a/src/flb_parser_logfmt.c
+++ b/src/flb_parser_logfmt.c
@@ -166,7 +166,7 @@ static int logfmt_parser(struct flb_parser *parser,
                                   parser->name, parser->time_fmt_full);
                         return -1;
                     }
-                    *time_lookup = flb_parser_tm2time(&tm);
+                    *time_lookup = flb_parser_tm2time(&tm, parser->time_system_timezone);
                 }
                 time_found = FLB_TRUE;
             }
diff --git a/src/flb_parser_ltsv.c b/src/flb_parser_ltsv.c
index dae458c9a4a..297f528515f 100644
--- a/src/flb_parser_ltsv.c
+++ b/src/flb_parser_ltsv.c
@@ -139,7 +139,7 @@ static int ltsv_parser(struct flb_parser *parser,
                                  parser->name, parser->time_fmt_full);
                        return -1;
                     }
-                    *time_lookup = flb_parser_tm2time(&tm);
+                    *time_lookup = flb_parser_tm2time(&tm, parser->time_system_timezone);
                 }
                 time_found = FLB_TRUE;
             }
diff --git a/src/flb_parser_regex.c b/src/flb_parser_regex.c
index 7982c7d4a42..5dc4a965a75 100644
--- a/src/flb_parser_regex.c
+++ b/src/flb_parser_regex.c
@@ -87,7 +87,7 @@ static void cb_results(const char *name, const char *value,
             }
 
             pcb->time_frac = frac;
-            pcb->time_lookup = flb_parser_tm2time(&tm);
+            pcb->time_lookup = flb_parser_tm2time(&tm, parser->time_system_timezone);
 
             if (parser->time_keep == FLB_FALSE) {
                 pcb->num_skipped++;
diff --git a/src/multiline/flb_ml_parser_cri.c b/src/multiline/flb_ml_parser_cri.c
index 1a4ac9bbc5a..e4bd6a0e0f3 100644
--- a/src/multiline/flb_ml_parser_cri.c
+++ b/src/multiline/flb_ml_parser_cri.c
@@ -40,6 +40,7 @@ static struct flb_parser *cri_parser_create(struct flb_config *config)
                           NULL,                    /* time offset */
                           FLB_TRUE,                /* time keep */
                           FLB_FALSE,               /* time strict */
+                          FLB_FALSE,               /* time system timezone */
                           FLB_FALSE,               /* no bare keys */
                           NULL,                    /* parser types */
                           0,                       /* types len */
diff --git a/src/multiline/flb_ml_parser_docker.c b/src/multiline/flb_ml_parser_docker.c
index 0573affab33..51550f3893e 100644
--- a/src/multiline/flb_ml_parser_docker.c
+++ b/src/multiline/flb_ml_parser_docker.c
@@ -35,6 +35,7 @@ static struct flb_parser *docker_parser_create(struct flb_config *config)
                           NULL,                   /* time offset */
                           FLB_TRUE,               /* time keep */
                           FLB_FALSE,              /* time strict */
+                          FLB_FALSE,              /* time system timezone */
                           FLB_FALSE,              /* no bare keys */
                           NULL,                   /* parser types */
                           0,                      /* types len */
diff --git a/tests/internal/fuzzers/engine_fuzzer.c b/tests/internal/fuzzers/engine_fuzzer.c
index 498b86a8fcc..5d7e9ab802b 100644
--- a/tests/internal/fuzzers/engine_fuzzer.c
+++ b/tests/internal/fuzzers/engine_fuzzer.c
@@ -143,7 +143,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv) {
 
     parser = flb_parser_create("timestamp", "regex", "^(?<time>.*)$", FLB_TRUE,
                                 "%s.%L", "time", NULL, MK_FALSE, 0, FLB_FALSE,
-                               NULL, 0, NULL, ctx->config);
+                               FLB_FALSE, NULL, 0, NULL, ctx->config);
     filter_ffd = flb_filter(ctx, (char *) "parser", NULL);
     int ret;
     ret = flb_filter_set(ctx, filter_ffd, "Match", "test",
diff --git a/tests/internal/fuzzers/parse_json_fuzzer.c b/tests/internal/fuzzers/parse_json_fuzzer.c
index dab8880d89c..b809436e7cb 100644
--- a/tests/internal/fuzzers/parse_json_fuzzer.c
+++ b/tests/internal/fuzzers/parse_json_fuzzer.c
@@ -51,7 +51,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size){
     }
 
     fuzz_parser = flb_parser_create("fuzzer", "json", NULL, FLB_TRUE, NULL,
-                                    NULL, NULL, MK_FALSE, MK_TRUE, FLB_FALSE,
+                                    NULL, NULL, MK_FALSE, MK_TRUE, FLB_FALSE, FLB_FALSE,
                                     NULL, 0, NULL, fuzz_config);
     if (fuzz_parser) {
         flb_parser_do(fuzz_parser, (char*)data, size,
diff --git a/tests/internal/fuzzers/parse_logfmt_fuzzer.c b/tests/internal/fuzzers/parse_logfmt_fuzzer.c
index c65a2adbcd5..b0d0d63deed 100644
--- a/tests/internal/fuzzers/parse_logfmt_fuzzer.c
+++ b/tests/internal/fuzzers/parse_logfmt_fuzzer.c
@@ -32,8 +32,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size){
     }
     fuzz_parser = flb_parser_create("fuzzer", "logfmt", NULL, FLB_TRUE,
                                     NULL, NULL, NULL, MK_FALSE,
-                                    MK_TRUE, FLB_FALSE, NULL, 0, NULL,
-                                    fuzz_config);
+                                    MK_TRUE, FLB_FALSE, FLB_FALSE, NULL, 0,
+                                    NULL, fuzz_config);
     if (fuzz_parser) {
         flb_parser_do(fuzz_parser, (char*)data, size,
                       &out_buf, &out_size, &out_time);
diff --git a/tests/internal/fuzzers/parse_ltsv_fuzzer.c b/tests/internal/fuzzers/parse_ltsv_fuzzer.c
index cb8bf95a58f..e170d39a297 100644
--- a/tests/internal/fuzzers/parse_ltsv_fuzzer.c
+++ b/tests/internal/fuzzers/parse_ltsv_fuzzer.c
@@ -19,8 +19,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size){
     fuzz_config = flb_config_init();
     fuzz_parser = flb_parser_create("fuzzer", "ltsv", NULL, FLB_TRUE,
                                     NULL, NULL, NULL, MK_FALSE, 
-                                    MK_TRUE, FLB_FALSE, NULL, 0, NULL,
-                                    fuzz_config);
+                                    MK_TRUE, FLB_FALSE, FLB_FALSE, NULL, 0,
+                                    NULL, fuzz_config);
     flb_parser_do(fuzz_parser, (char*)data, size,
                   &out_buf, &out_size, &out_time);
 
diff --git a/tests/internal/fuzzers/parser_fuzzer.c b/tests/internal/fuzzers/parser_fuzzer.c
index a035555166c..d99b91e6acf 100644
--- a/tests/internal/fuzzers/parser_fuzzer.c
+++ b/tests/internal/fuzzers/parser_fuzzer.c
@@ -154,7 +154,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
     /* now call into the parser */
     fuzz_parser = flb_parser_create("fuzzer", format, pregex, FLB_TRUE,
             time_fmt, time_key, time_offset, time_keep, 0, FLB_FALSE,
-            types, types_len, list, fuzz_config);
+            FLB_FALSE, types, types_len, list, fuzz_config);
 
     /* Second step is to use the random parser to parse random input */
     if (fuzz_parser != NULL) {
diff --git a/tests/internal/parser.c b/tests/internal/parser.c
index 6a560db716c..b7b4eab876b 100644
--- a/tests/internal/parser.c
+++ b/tests/internal/parser.c
@@ -231,7 +231,7 @@ void test_parser_time_lookup()
             continue;
         }
 
-        epoch = flb_parser_tm2time(&tm);
+        epoch = flb_parser_tm2time(&tm, FLB_FALSE);
         epoch -= year_diff;
         TEST_CHECK(t->epoch == epoch);
         TEST_CHECK(t->frac_seconds == ns);
diff --git a/tests/internal/parser_json.c b/tests/internal/parser_json.c
index 5a9b6eadbfe..f09f9675794 100644
--- a/tests/internal/parser_json.c
+++ b/tests/internal/parser_json.c
@@ -171,7 +171,7 @@ void test_basic()
     }
 
     parser = flb_parser_create("json", "json", NULL, FLB_FALSE, NULL, NULL, NULL,
-                               FLB_FALSE, FLB_FALSE, FLB_FALSE,
+                               FLB_FALSE, FLB_FALSE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, NULL, config);
     if (!TEST_CHECK(parser != NULL)) {
         TEST_MSG("flb_parser_create failed");
@@ -223,7 +223,7 @@ void test_time_key()
     }
 
     parser = flb_parser_create("json", "json", NULL, FLB_FALSE, "%Y-%m-%dT%H:%M:%S.%L", "time", NULL,
-                               FLB_FALSE, FLB_FALSE, FLB_FALSE,
+                               FLB_FALSE, FLB_FALSE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, NULL, config);
     if (!TEST_CHECK(parser != NULL)) {
         TEST_MSG("flb_parser_create failed");
@@ -284,7 +284,7 @@ void test_time_keep()
     }
 
     parser = flb_parser_create("json", "json", NULL, FLB_FALSE, "%Y-%m-%dT%H:%M:%S.%L", "time", NULL,
-                               FLB_TRUE /*time_keep */, FLB_FALSE, FLB_FALSE,
+                               FLB_TRUE /*time_keep */, FLB_FALSE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, NULL, config);
     if (!TEST_CHECK(parser != NULL)) {
         TEST_MSG("flb_parser_create failed");
@@ -365,7 +365,7 @@ void test_types_is_not_supported()
     types->type = FLB_PARSER_TYPE_HEX;
 
     parser = flb_parser_create("json", "json", NULL, FLB_FALSE, NULL, NULL, NULL,
-                               FLB_FALSE, FLB_FALSE, FLB_FALSE,
+                               FLB_FALSE, FLB_FALSE, FLB_FALSE, FLB_FALSE,
                                types, 1, NULL, config);
     if (!TEST_CHECK(parser != NULL)) {
         TEST_MSG("flb_parser_create failed");
@@ -450,7 +450,7 @@ void test_decode_field_json()
     }
 
     parser = flb_parser_create("json", "json", NULL, FLB_FALSE, NULL, NULL, NULL,
-                               FLB_FALSE, FLB_FALSE, FLB_FALSE,
+                               FLB_FALSE, FLB_FALSE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, decoder, config);
     if (!TEST_CHECK(parser != NULL)) {
         TEST_MSG("flb_parser_create failed");
@@ -505,7 +505,7 @@ void test_time_key_kept_if_parse_fails()
     }
 
     parser = flb_parser_create("json", "json", NULL, FLB_FALSE, time_format, "time", NULL,
-                               FLB_FALSE, FLB_TRUE, FLB_FALSE,
+                               FLB_FALSE, FLB_TRUE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, NULL, config);
     if (!TEST_CHECK(parser != NULL)) {
         TEST_MSG("flb_parser_create failed");
diff --git a/tests/internal/parser_logfmt.c b/tests/internal/parser_logfmt.c
index ea363c53ab2..3e644ee2d53 100644
--- a/tests/internal/parser_logfmt.c
+++ b/tests/internal/parser_logfmt.c
@@ -171,7 +171,7 @@ void test_basic()
     }
 
     parser = flb_parser_create("logfmt", "logfmt", NULL, FLB_FALSE, NULL, NULL, NULL,
-                               FLB_FALSE, FLB_FALSE, FLB_FALSE,
+                               FLB_FALSE, FLB_FALSE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, NULL, config);
     if (!TEST_CHECK(parser != NULL)) {
         TEST_MSG("flb_parser_create failed");
@@ -223,7 +223,7 @@ void test_time_key()
     }
 
     parser = flb_parser_create("logfmt", "logfmt", NULL, FLB_FALSE, "%Y-%m-%dT%H:%M:%S.%L", "time", NULL,
-                               FLB_FALSE, FLB_FALSE, FLB_FALSE,
+                               FLB_FALSE, FLB_FALSE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, NULL, config);
     if (!TEST_CHECK(parser != NULL)) {
         TEST_MSG("flb_parser_create failed");
@@ -284,7 +284,7 @@ void test_time_keep()
     }
 
     parser = flb_parser_create("logfmt", "logfmt", NULL, FLB_FALSE, "%Y-%m-%dT%H:%M:%S.%L", "time", NULL,
-                               FLB_TRUE /*time_keep */, FLB_FALSE, FLB_FALSE,
+                               FLB_TRUE /*time_keep */, FLB_FALSE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, NULL, config);
     if (!TEST_CHECK(parser != NULL)) {
         TEST_MSG("flb_parser_create failed");
@@ -361,7 +361,7 @@ void test_types()
     types->type = FLB_PARSER_TYPE_HEX;
 
     parser = flb_parser_create("logfmt", "logfmt", NULL, FLB_FALSE, NULL, NULL, NULL,
-                               FLB_FALSE, FLB_FALSE, FLB_FALSE,
+                               FLB_FALSE, FLB_FALSE, FLB_FALSE, FLB_FALSE,
                                types, 1, NULL, config);
     if (!TEST_CHECK(parser != NULL)) {
         TEST_MSG("flb_parser_create failed");
diff --git a/tests/internal/parser_ltsv.c b/tests/internal/parser_ltsv.c
index 3f9170518aa..c4592c7f2ae 100644
--- a/tests/internal/parser_ltsv.c
+++ b/tests/internal/parser_ltsv.c
@@ -171,7 +171,7 @@ void test_basic()
     }
 
     parser = flb_parser_create("ltsv", "ltsv", NULL, FLB_FALSE, NULL, NULL, NULL,
-                               FLB_FALSE, FLB_FALSE, FLB_FALSE,
+                               FLB_FALSE, FLB_FALSE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, NULL, config);
     if (!TEST_CHECK(parser != NULL)) {
         TEST_MSG("flb_parser_create failed");
@@ -223,7 +223,7 @@ void test_time_key()
     }
 
     parser = flb_parser_create("ltsv", "ltsv", NULL, FLB_FALSE, "%Y-%m-%dT%H:%M:%S.%L", "time", NULL,
-                               FLB_FALSE, FLB_FALSE, FLB_FALSE,
+                               FLB_FALSE, FLB_FALSE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, NULL, config);
     if (!TEST_CHECK(parser != NULL)) {
         TEST_MSG("flb_parser_create failed");
@@ -284,7 +284,7 @@ void test_time_keep()
     }
 
     parser = flb_parser_create("ltsv", "ltsv", NULL, FLB_FALSE, "%Y-%m-%dT%H:%M:%S.%L", "time", NULL,
-                               FLB_TRUE /*time_keep */, FLB_FALSE, FLB_FALSE,
+                               FLB_TRUE /*time_keep */, FLB_FALSE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, NULL, config);
     if (!TEST_CHECK(parser != NULL)) {
         TEST_MSG("flb_parser_create failed");
@@ -361,7 +361,7 @@ void test_types()
     types->type = FLB_PARSER_TYPE_HEX;
 
     parser = flb_parser_create("ltsv", "ltsv", NULL, FLB_FALSE, NULL, NULL, NULL,
-                               FLB_FALSE, FLB_FALSE, FLB_FALSE,
+                               FLB_FALSE, FLB_FALSE, FLB_FALSE, FLB_FALSE,
                                types, 1, NULL, config);
     if (!TEST_CHECK(parser != NULL)) {
         TEST_MSG("flb_parser_create failed");
@@ -446,7 +446,7 @@ void test_decode_field_json()
     }
 
     parser = flb_parser_create("ltsv", "ltsv", NULL, FLB_FALSE, NULL, NULL, NULL,
-                               FLB_FALSE, FLB_FALSE, FLB_FALSE,
+                               FLB_FALSE, FLB_FALSE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, decoder, config);
     if (!TEST_CHECK(parser != NULL)) {
         TEST_MSG("flb_parser_create failed");
diff --git a/tests/internal/parser_regex.c b/tests/internal/parser_regex.c
index 2283231ce57..f919dd21587 100644
--- a/tests/internal/parser_regex.c
+++ b/tests/internal/parser_regex.c
@@ -172,7 +172,7 @@ void test_basic()
     }
 
     parser = flb_parser_create("regex", "regex", regex, FLB_FALSE, NULL, NULL, NULL,
-                               FLB_FALSE, FLB_FALSE, FLB_FALSE,
+                               FLB_FALSE, FLB_FALSE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, NULL, config);
     if (!TEST_CHECK(parser != NULL)) {
         TEST_MSG("flb_parser_create failed");
@@ -225,7 +225,7 @@ void test_time_key()
     }
 
     parser = flb_parser_create("regex", "regex", regex, FLB_FALSE, "%Y-%m-%dT%H:%M:%S.%L", "time", NULL,
-                               FLB_FALSE, FLB_FALSE, FLB_FALSE,
+                               FLB_FALSE, FLB_FALSE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, NULL, config);
     if (!TEST_CHECK(parser != NULL)) {
         TEST_MSG("flb_parser_create failed");
@@ -287,7 +287,7 @@ void test_time_keep()
     }
 
     parser = flb_parser_create("regex", "regex", regex, FLB_FALSE, "%Y-%m-%dT%H:%M:%S.%L", "time", NULL,
-                               FLB_TRUE /*time_keep */, FLB_FALSE, FLB_FALSE,
+                               FLB_TRUE /*time_keep */, FLB_FALSE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, NULL, config);
     if (!TEST_CHECK(parser != NULL)) {
         TEST_MSG("flb_parser_create failed");
@@ -365,7 +365,7 @@ void test_types()
     types->type = FLB_PARSER_TYPE_HEX;
 
     parser = flb_parser_create("regex", "regex", regex, FLB_FALSE, NULL, NULL, NULL,
-                               FLB_FALSE, FLB_FALSE, FLB_FALSE,
+                               FLB_FALSE, FLB_FALSE, FLB_FALSE, FLB_FALSE,
                                types, 1, NULL, config);
     if (!TEST_CHECK(parser != NULL)) {
         TEST_MSG("flb_parser_create failed");
@@ -451,7 +451,7 @@ void test_decode_field_json()
     }
 
     parser = flb_parser_create("regex", "regex", regex, FLB_FALSE, NULL, NULL, NULL,
-                               FLB_FALSE, FLB_FALSE, FLB_FALSE,
+                               FLB_FALSE, FLB_FALSE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, decoder, config);
     if (!TEST_CHECK(parser != NULL)) {
         TEST_MSG("flb_parser_create failed");
diff --git a/tests/runtime/filter_parser.c b/tests/runtime/filter_parser.c
index c31fbcf840b..539c163a41e 100644
--- a/tests/runtime/filter_parser.c
+++ b/tests/runtime/filter_parser.c
@@ -108,7 +108,7 @@ void flb_test_filter_parser_extract_fields()
     /* Parser */
     parser = flb_parser_create("dummy_test", "regex", "^(?<INT>[^ ]+) (?<FLOAT>[^ ]+) (?<BOOL>[^ ]+) (?<STRING>.+)$",
                                FLB_TRUE,
-                               NULL, NULL, NULL, MK_FALSE, MK_TRUE, FLB_FALSE, NULL, 0,
+                               NULL, NULL, NULL, MK_FALSE, MK_TRUE, FLB_FALSE, FLB_FALSE, NULL, 0,
                                NULL, ctx->config);
     TEST_CHECK(parser != NULL);
 
@@ -195,7 +195,7 @@ void flb_test_filter_parser_reserve_data_off()
     /* Parser */
     parser = flb_parser_create("dummy_test", "regex", "^(?<INT>[^ ]+) (?<FLOAT>[^ ]+) (?<BOOL>[^ ]+) (?<STRING>.+)$",
                                FLB_TRUE,
-                               NULL, NULL, NULL, MK_FALSE, MK_TRUE, FLB_FALSE, NULL, 0,
+                               NULL, NULL, NULL, MK_FALSE, MK_TRUE, FLB_FALSE, FLB_FALSE, NULL, 0,
                                NULL, ctx->config);
     TEST_CHECK(parser != NULL);
 
@@ -273,7 +273,7 @@ void flb_test_filter_parser_handle_time_key()
     parser = flb_parser_create("timestamp", "regex", "^(?<time>.*)$", FLB_TRUE,
                                "%Y-%m-%dT%H:%M:%S.%L",
                                "time",
-                               NULL, MK_FALSE, MK_TRUE, FLB_FALSE,
+                               NULL, MK_FALSE, MK_TRUE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, NULL, ctx->config);
     TEST_CHECK(parser != NULL);
 
@@ -351,7 +351,7 @@ void flb_test_filter_parser_handle_time_key_with_fractional_timestamp()
     parser = flb_parser_create("timestamp", "regex", "^(?<time>.*)$", FLB_TRUE,
                                "%s.%L",
                                "time",
-                               NULL, MK_FALSE, MK_TRUE, FLB_FALSE,
+                               NULL, MK_FALSE, MK_TRUE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, NULL, ctx->config);
     TEST_CHECK(parser != NULL);
 
@@ -439,6 +439,7 @@ void flb_test_filter_parser_handle_time_key_with_time_zone()
                                NULL, // time_offset
                                MK_FALSE, // time_keep
                                MK_TRUE, // time_strict
+                               FLB_FALSE, // time_system_timezone
                                MK_FALSE, // logfmt_no_bare_keys
                                NULL, // types
                                0, // types_len
@@ -491,6 +492,133 @@ void flb_test_filter_parser_handle_time_key_with_time_zone()
     flb_destroy(ctx);
 }
 
+void test_parser_timestamp_timezone(char *tz,
+                                     char *time_fmt, 
+                                     char *timestamp, 
+                                     char *expected_epoch,
+                                     int use_system_timezone) 
+{
+    int ret;
+    int bytes;
+    char *output, *original_tz;
+    char p[256];
+    char expected[12];
+    flb_ctx_t *ctx;
+    int in_ffd;
+    int out_ffd;
+    int filter_ffd;
+    struct flb_parser *parser;
+
+    struct flb_lib_out_cb cb;
+    cb.cb   = callback_test;
+    cb.data = NULL;
+
+    clear_output();
+
+    ctx = flb_create();
+
+    /* Configure service */
+    flb_service_set(ctx, "Flush", FLUSH_INTERVAL, "Grace", "1", "Log_Level", "debug", NULL);
+
+    /* Input */
+    in_ffd = flb_input(ctx, (char *) "lib", NULL);
+    TEST_CHECK(in_ffd >= 0);
+    flb_input_set(ctx, in_ffd,
+                  "Tag", "test",
+                  NULL);
+
+    /* Parser */
+    parser = flb_parser_create("timestamp", // name
+                               "regex", // format
+                               "^(?<time>.*)$", // regex
+                               FLB_TRUE, // skip_empty
+                               time_fmt, // time_fmt
+                               "time", // time_key
+                               NULL, // time_offset
+                               MK_FALSE, // time_keep
+                               MK_TRUE, // time_strict
+                               use_system_timezone, // time_system_timezone
+                               MK_FALSE, // logfmt_no_bare_keys
+                               NULL, // types
+                               0, // types_len
+                               NULL, // decoders
+                               ctx->config); // config
+    TEST_CHECK(parser != NULL);
+
+    /* Filter */
+    filter_ffd = flb_filter(ctx, (char *) "parser", NULL);
+    TEST_CHECK(filter_ffd >= 0);
+    ret = flb_filter_set(ctx, filter_ffd,
+                         "Match", "test",
+                         "Key_Name", "@timestamp",
+                         "Parser", "timestamp",
+                         "Reserve_Data", "On",
+                         NULL);
+    TEST_CHECK(ret == 0);
+
+    /* Output */
+    out_ffd = flb_output(ctx, (char *) "lib", &cb);
+    TEST_CHECK(out_ffd >= 0);
+    flb_output_set(ctx, out_ffd,
+                   "Match", "*",
+                   "format", "json",
+                   NULL);
+
+    /* Temporarily set the system timezone for this test */
+    if (tz) {
+        original_tz = getenv("TZ");
+        ret = setenv("TZ", tz, 1);
+        TEST_ASSERT(ret == 0);
+    }
+
+    /* Start the engine */
+    ret = flb_start(ctx);
+    TEST_CHECK(ret == 0);
+    if (ret != 0) {
+        flb_destroy(ctx);
+        return;
+    }
+
+    /* Ingest data. */
+    snprintf(p, 256, "[1448403340, {\"@timestamp\":\"%s\", \"message\":\"This is an example\"}]", timestamp);
+    bytes = flb_lib_push(ctx, in_ffd, p, strlen(p));
+    TEST_CHECK(bytes == strlen(p));
+
+    wait_with_timeout(2000, &output); /* waiting flush and ensuring data flush */
+    TEST_CHECK_(output != NULL, "Expected output to not be NULL");
+    if (output != NULL) {
+        snprintf(expected, 12, "[%s", expected_epoch);
+        TEST_CHECK_(strstr(output, expected) != NULL, "Expected output to contain '%s', got '%s'", expected, output);
+    }
+
+    /* Reset original timezone */
+    if (original_tz) {
+        ret = setenv("TZ", original_tz, 1);
+        TEST_CHECK(ret == 0);
+    }
+
+    flb_stop(ctx);
+    flb_destroy(ctx);
+}
+
+void flb_test_filter_parser_use_system_timezone()
+{
+    test_parser_timestamp_timezone("EST5EDT", /* char *tz */
+                                   "%Y-%m-%d:%H:%M:%S", /* char *time_fmt */ 
+                                   "2023-10-17:05:00:00", /* char *timestamp */
+                                   "1697536800", /* char *expected_epoch */
+                                   FLB_TRUE); /* int use_system_timezone */
+}
+
+void flb_test_filter_parser_use_system_timezone_zone_in_timestamp()
+{
+    test_parser_timestamp_timezone("EST5EDT", /* char *tz */
+                                   "%Y-%m-%d:%H:%M:%S%z", /* char *time_fmt */ 
+                                   "2023-10-17:05:00:00-0700", /* char *timestamp */
+                                   "1697536800", /* char *expected_epoch */
+                                   FLB_TRUE); /* int use_system_timezone */
+}
+
 void flb_test_filter_parser_ignore_malformed_time()
 {
     int ret;
@@ -524,7 +652,7 @@ void flb_test_filter_parser_ignore_malformed_time()
     parser = flb_parser_create("timestamp", "regex",
                                "^(?<time>.*)$", FLB_TRUE,
                                "%Y-%m-%dT%H:%M:%S.%L", "time",
-                               NULL, FLB_FALSE, MK_TRUE, FLB_FALSE,
+                               NULL, FLB_FALSE, MK_TRUE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, NULL, ctx->config);
     TEST_CHECK(parser != NULL);
 
@@ -602,7 +730,7 @@ void flb_test_filter_parser_preserve_original_field()
     /* Parser */
     parser = flb_parser_create("dummy_test", "regex", "^(?<INT>[^ ]+) (?<FLOAT>[^ ]+) (?<BOOL>[^ ]+) (?<STRING>.+)$",
                                FLB_TRUE,
-                               NULL, NULL, NULL, MK_FALSE, MK_TRUE, FLB_FALSE, NULL, 0,
+                               NULL, NULL, NULL, MK_FALSE, MK_TRUE, FLB_FALSE, FLB_FALSE, NULL, 0,
                                NULL, ctx->config);
     TEST_CHECK(parser != NULL);
 
@@ -687,13 +815,13 @@ void flb_test_filter_parser_first_matched_when_mutilple_parser()
     /* Parser */
     parser = flb_parser_create("one", "regex", "^(?<one>.+?)$",
                                FLB_TRUE,
-                               NULL, NULL, NULL, MK_FALSE, MK_TRUE, FLB_FALSE,
+                               NULL, NULL, NULL, MK_FALSE, MK_TRUE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, NULL, ctx->config);
     TEST_CHECK(parser != NULL);
 
     parser = flb_parser_create("two", "regex", "^(?<two>.+?)$",
                                FLB_TRUE,
-                               NULL, NULL, NULL, MK_FALSE, MK_TRUE, FLB_FALSE,
+                               NULL, NULL, NULL, MK_FALSE, MK_TRUE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, NULL, ctx->config);
     TEST_CHECK(parser != NULL);
 
@@ -774,7 +902,7 @@ void flb_test_filter_parser_skip_empty_values_false()
     /* Parser */
     parser = flb_parser_create("one", "regex", "^(?<one>.+?)$",
                                FLB_FALSE,
-                               NULL, NULL, NULL, MK_FALSE, MK_TRUE, FLB_FALSE,
+                               NULL, NULL, NULL, MK_FALSE, MK_TRUE, FLB_FALSE, FLB_FALSE,
                                NULL, 0, NULL, ctx->config);
     TEST_CHECK(parser != NULL);
 
@@ -818,12 +946,13 @@ void flb_test_filter_parser_skip_empty_values_false()
     flb_destroy(ctx);
 }
 
-
 TEST_LIST = {
     {"filter_parser_extract_fields", flb_test_filter_parser_extract_fields },
     {"filter_parser_reserve_data_off", flb_test_filter_parser_reserve_data_off },
     {"filter_parser_handle_time_key", flb_test_filter_parser_handle_time_key },
     {"filter_parser_handle_time_key_with_time_zone", flb_test_filter_parser_handle_time_key_with_time_zone },
+    {"filter_parser_use_system_timezone", flb_test_filter_parser_use_system_timezone },
+    {"filter_parser_use_system_timezone_zone_in_timestamp",flb_test_filter_parser_use_system_timezone_zone_in_timestamp },
     {"filter_parser_ignore_malformed_time", flb_test_filter_parser_ignore_malformed_time },
     {"filter_parser_preserve_original_field", flb_test_filter_parser_preserve_original_field },
     {"filter_parser_first_matched_when_multiple_parser", flb_test_filter_parser_first_matched_when_mutilple_parser },