# 8 hours difference in time zone

**URL:** <https://discuss.elastic.co/t/8-hours-difference-in-time-zone/126536>\
**Category:** Logstash\
**Created:** [April 3, 2018, 9:11am UTC](https://discuss.elastic.co/t/8-hours-difference-in-time-zone/126536 "2018-04-03T09:11:56Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![chenzilong444](https://avatars.discourse-cdn.com/v4/letter/c/bbe5ce/32.png) [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\
**Post date:** [April 3, 2018, 9:11am UTC](https://discuss.elastic.co/t/8-hours-difference-in-time-zone/126536/1 "2018-04-03T09:11:57Z")

</div>

```
elasticsearch { 
					hosts => localhost	  	
					index => "logstash(%{+YYYY.MM.dd})"  
					document_type =>"logstash"
					flush_size=>1000 
				idle_flush_time=>15
					}  

```

i didn‘’t set date in logstash  
@timestamp April 1st 2018, 00:13:49.395  
\_index logstash(2018.03.31)  
i don‘t know why

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 3, 2018, 9:43am UTC](https://discuss.elastic.co/t/8-hours-difference-in-time-zone/126536/2 "2018-04-03T09:43:36Z")

</div>

That is based on the `@timestamp` field, which is always in UTC.

---

<div class="post-metadata">

**Author:** ![chenzilong444](https://avatars.discourse-cdn.com/v4/letter/c/bbe5ce/32.png) [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\
**Post date:** [April 3, 2018, 9:51am UTC](https://discuss.elastic.co/t/8-hours-difference-in-time-zone/126536/3 "2018-04-03T09:51:45Z")

</div>

can i save my time zone logstash(%{+YYYY.MM.dd}?  
maybe change @timestamp

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 3, 2018, 9:55am UTC](https://discuss.elastic.co/t/8-hours-difference-in-time-zone/126536/4 "2018-04-03T09:55:27Z")

</div>

Elasticsearch assumes timestamps are in UTC, so changing this will likely cause problems in other areas. You may be able to create a separate date string you can use based on the original timestamp.

Why do you need the index name to be based on the local timezone?

---

<div class="post-metadata">

**Author:** ![chenzilong444](https://avatars.discourse-cdn.com/v4/letter/c/bbe5ce/32.png) [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\
**Post date:** [April 3, 2018, 10:00am UTC](https://discuss.elastic.co/t/8-hours-difference-in-time-zone/126536/5 "2018-04-03T10:00:53Z")

</div>

because i need statistics events daily  
but some events before 8 o‘’clock today's Report in the yesterday index

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 3, 2018, 10:02am UTC](https://discuss.elastic.co/t/8-hours-difference-in-time-zone/126536/6 "2018-04-03T10:02:08Z")

</div>

What does the original event and timestamp look like?

---

<div class="post-metadata">

**Author:** ![chenzilong444](https://avatars.discourse-cdn.com/v4/letter/c/bbe5ce/32.png) [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\
**Post date:** [April 3, 2018, 10:11am UTC](https://discuss.elastic.co/t/8-hours-difference-in-time-zone/126536/7 "2018-04-03T10:11:19Z")

</div>

like that 2018-04-03T09:54:24.744Z？

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 3, 2018, 10:24am UTC](https://discuss.elastic.co/t/8-hours-difference-in-time-zone/126536/8 "2018-04-03T10:24:50Z")

</div>

Where is your data coming from?

---

<div class="post-metadata">

**Author:** ![chenzilong444](https://avatars.discourse-cdn.com/v4/letter/c/bbe5ce/32.png) [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\
**Post date:** [April 3, 2018, 11:12am UTC](https://discuss.elastic.co/t/8-hours-difference-in-time-zone/126536/9 "2018-04-03T11:12:16Z")

</div>

logstash stdout

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 3, 2018, 11:29am UTC](https://discuss.elastic.co/t/8-hours-difference-in-time-zone/126536/10 "2018-04-03T11:29:09Z")

</div>

Where are you collecting it from? Can you post a sample event?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2018, 11:29am UTC](https://discuss.elastic.co/t/8-hours-difference-in-time-zone/126536/11 "2018-05-01T11:29:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.