Q:

Is there a difference between "Etc/UTC" and "UTC" in logstash?

Im parsing W3C IIS logs and I'm using what I found in this article as a starter.
But this part of his logstash config Im unsure of:
  ## Set the Event Timesteamp from the log
  #
  date {
    match => [ "log_timestamp", "YYYY-MM-dd HH:mm:ss" ]
      timezone => "Etc/UTC"
  }

log_timestamp comes from: match => ["message", "%{TIMESTAMP_ISO8601:log_timestamp}.....
My question is why is he using "Etc/UTC" and not just "UTC"? This is the only example I could find online of a logstash config using "Etc/UTC". 
Is this necessary because of IIS? What would happen if I just did UTC? They should be identical (etc/UTC just the "long" name) but I want to confirm.

A:

The supported timezones for the date filter are listed here:
http://joda-time.sourceforge.net/timezones.html
Etc/UTC is one of the allowed timezones for Universal Time Coordinated. UTC is also an allowed value. They're synonyms.

