Fixing zabbix timezone code

[JeffAshton]

@nsano-rururu, the test case test_zabbix_basic fails if the current timezone is not UTC.

=================================== FAILURES ===================================
______________________________ test_zabbix_basic _______________________________

caplog = <_pytest.logging.LogCaptureFixture object at 0x7fabd89de190>

    def test_zabbix_basic(caplog):
        caplog.set_level(logging.WARNING)
        rule = {
            'name': 'Basic Zabbix test',
            'type': 'any',
            'alert_text_type': 'alert_text_only',
            'alert': [],
            'alert_subject': 'Test Zabbix',
            'zbx_host': 'example.com',
            'zbx_key': 'example-key'
        }
        rules_loader = FileRulesLoader({})
        rules_loader.load_modules(rule)
        alert = ZabbixAlerter(rule)
        match = {
            '@timestamp': '2021-01-01T00:00:00Z',
            'somefield': 'foobarbaz'
        }
        with mock.patch('pyzabbix.ZabbixSender.send') as mock_zbx_send:
            alert.alert([match])
    
            zabbix_metrics = {
                "host": "example.com",
                "key": "example-key",
                "value": "1",
                "clock": 1609459200
            }
            alerter_args = mock_zbx_send.call_args.args
>           assert vars(alerter_args[0][0]) == zabbix_metrics
E           AssertionError: assert {'clock': 160... 'value': '1'} == {'clock': 160... 'value': '1'}
E             Omitting 3 identical items, use -vv to show
E             Differing items:
E             {'clock': 1609477200} != {'clock': 1609459200}
E             Use -v to get the full diff

tests/alerters/zabbix_test.py:39: AssertionError
------------------------------ Captured log call -------------------------------
WARNING  elastalert:zabbix.py:84 Missing zabbix host 'example.com' or host's item 'example-key', alert will be discarded
------------- generated xml file: /tmp/tmp-135248PYktsmhWQN7b.xml --------------
=========================== short test summary info ============================
FAILED tests/alerters/zabbix_test.py::test_zabbix_basic - AssertionError: ass...
========================= 1 failed, 6 passed in 0.57s ==========================

[JeffAshton]

Using just Z parses the timezone incorrectly.

[JeffAshton]

Returns the unix epoch as a float instead of a string.

[jertel]

@nsano-rururu Will you please review this? My primary concern is whether the parse using %z will cause any problem if some ES clusters use a timestamp format of ...Z and others use ...+05:00. The docs for %z state it expects the latter.

[JeffAshton]

@nsano-rururu Will you please review this? My primary concern is whether the parse using %z will cause any problem if some ES clusters use a timestamp format of ...Z and others use ...+05:00. The docs for %z state it expects the latter.

@nsano-rururu Will you please review this? My primary concern is whether the parse using %z will cause any problem if some ES clusters use a timestamp format of ...Z and others use ...+05:00. The docs for %z state it expects the latter.

Z is just a short form for +00:00. With %z it will actually match the timezone properly, but as currently written it doesn't process the timezone correctly:

>>> datetime.strptime('2021-06-28T21:27:00Z', '%Y-%m-%dT%H:%M:%S%z')
datetime.datetime(2021, 6, 28, 21, 27, tzinfo=datetime.timezone.utc)

vs

>>> datetime.strptime('2021-06-28T21:27:00Z', '%Y-%m-%dT%H:%M:%SZ')
datetime.datetime(2021, 6, 28, 21, 27)

[nsano-rururu]

I get a lot of my names for some reason, but I'm not sure because zabbix_basic wasn't made by me.
zabbix_basic was made by @ferozsalam

[JeffAshton]

I get a lot of my names for some reason, but I'm not sure because zabbix_basic wasn't made by me.
zabbix_basic was made by @ferozsalam

My bad. This demonstrates %z in action:

UTC: Z

>>> datetime.strptime('2021-06-28T21:27:00Z', '%Y-%m-%dT%H:%M:%S%z')
datetime.datetime(2021, 6, 28, 21, 27, tzinfo=datetime.timezone.utc)

UTC: +00:00

>>> datetime.strptime('2021-06-28T21:27:00+00:00', '%Y-%m-%dT%H:%M:%S%z')
datetime.datetime(2021, 6, 28, 21, 27, tzinfo=datetime.timezone.utc)

EST

>>> datetime.strptime('2021-06-28T21:27:00+05:00', '%Y-%m-%dT%H:%M:%S%z')
datetime.datetime(2021, 6, 28, 21, 27, tzinfo=datetime.timezone(datetime.timedelta(seconds=18000)))

Doing just Z, it's treated just as a character, but not as a timezone.