Summary

Parse timezone offset information already present in log timestamps (currently discarded), normalize all timestamps to UTC in internal data structures, and support mixed-timezone log files.

Motivation

Many log formats include timezone offsets in their timestamps (e.g., +0000, -0500, +05:30). ltl currently discards this information. When analyzing logs from multiple sources or systems in different timezones, timestamps must be normalized to a common base (UTC) for correct time-bucket alignment and statistical analysis.

Proposed behavior

• During parsing, capture the timezone offset from timestamps that include one
• Normalize all parsed timestamps to UTC before storing in internal data structures (%log_analysis, %log_occurrences, etc.)
• Internal data structures are always UTC — this is a hard rule
• Mixed-timezone logs (e.g., concatenated files from servers in different timezones) are correctly aligned
• For logs without timezone information, assume UTC (or allow a default via CLI option)
• Users control display timezone via the render-side offset from Fixed timezone offset for rendering #154

Dependency

Depends on #154 (render-side timezone offset). Without it, UTC-normalized data would always render in UTC with no way to shift to local time. The two features compose: this issue normalizes in, #154 shifts out.

These two issues should be designed together to ensure the internal architecture is clean — parsing normalizes to UTC, rendering applies the user's preferred offset.

Replaces

Split from #153, which combined two separate enhancements.