# About logstash date time zone questions **URL:** \ **Category:** Logstash\ **Created:** [December 6, 2018, 1:37am UTC](https://discuss.elastic.co/t/about-logstash-date-time-zone-questions/159631 "2018-12-06T01:37:13Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![yuxiao](https://avatars.discourse-cdn.com/v4/letter/y/ad7895/32.png) [@yuxiao](https://discuss.elastic.co/u/yuxiao)\ **Post date:** [December 6, 2018, 1:37am UTC](https://discuss.elastic.co/t/about-logstash-date-time-zone-questions/159631/1 "2018-12-06T01:37:13Z")
I use logstash-input-jdbc sync data from mysql to elasticsearch, in mysql have time field, the type is timestamp,locale time zone is +8:00, but sync to elasticsearch,the time value less 8 hours, who knows the answer,please help!!! ---
**Author:** ![Petr.Simik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/petr.simik/32/38082_2.png) [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Post date:** [December 6, 2018, 5:41am UTC](https://discuss.elastic.co/t/about-logstash-date-time-zone-questions/159631/2 "2018-12-06T05:41:39Z")
You can define the timezone with date filter check the reference > **[Date filter plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html)** I use for instance: > ``` > date { > match => ["msg_timestamp", "YYYYMMddHHmmss"] > timezone => "Etc/UTC" > target => "msg_timestamp" > } > > ``` ---
**Author:** ![yuxiao](https://avatars.discourse-cdn.com/v4/letter/y/ad7895/32.png) [@yuxiao](https://discuss.elastic.co/u/yuxiao)\ **Post date:** [December 11, 2018, 9:33am UTC](https://discuss.elastic.co/t/about-logstash-date-time-zone-questions/159631/3 "2018-12-11T09:33:15Z")
yes,i used any format,but failed,i use mysql, the time type is timsstamp, which format i should be? ---
**Author:** ![admlko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/admlko/32/21787_2.png) [@admlko](https://discuss.elastic.co/u/admlko)\ **Post date:** [December 11, 2018, 9:46am UTC](https://discuss.elastic.co/t/about-logstash-date-time-zone-questions/159631/4 "2018-12-11T09:46:19Z")
Well, if the format is unix timestamp (epoch), the format should be either UNIX or UNIX\_MS (if the timestamp includes milliseconds) according to the documentation: [https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-match](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-match) So change the match to ```auto match => ["msg_timestamp", "UNIX"] ``` If it still does not work, we need to see an example of the data and your config exactly. ---
**Author:** ![yuxiao](https://avatars.discourse-cdn.com/v4/letter/y/ad7895/32.png) [@yuxiao](https://discuss.elastic.co/u/yuxiao)\ **Post date:** [December 11, 2018, 10:00am UTC](https://discuss.elastic.co/t/about-logstash-date-time-zone-questions/159631/5 "2018-12-11T10:00:07Z")
In MySQL type is timestamp, the problem is i don't know the type format, in not convert, the elasticsearch show is {"updated\_at": "2018-11-16T08:00:01.000Z"}, so which format suit? ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/8/38dca6c02f5c68b10df7102cda129015d36d437d.png) ---
**Author:** ![admlko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/admlko/32/21787_2.png) [@admlko](https://discuss.elastic.co/u/admlko)\ **Post date:** [December 11, 2018, 10:23am UTC](https://discuss.elastic.co/t/about-logstash-date-time-zone-questions/159631/6 "2018-12-11T10:23:51Z")
In which format is the timestamp in mysql? Can you show a sample of the data? Is it in local time or UTC? You want to save the data in UTC (with date filter) into Elasticsearch, Kibana will handle conversion to your local timezone if you use it. ---
**Author:** ![yuxiao](https://avatars.discourse-cdn.com/v4/letter/y/ad7895/32.png) [@yuxiao](https://discuss.elastic.co/u/yuxiao)\ **Post date:** [December 11, 2018, 10:41am UTC](https://discuss.elastic.co/t/about-logstash-date-time-zone-questions/159631/7 "2018-12-11T10:41:03Z")
Timestamp is one kind of mysql time type, In mysql is local time, but into Elasticsearch is UTC, then less timezone hours,i use the Elasticsearch data by another application but Kibana,so i want the time in Elasticsearch show correctly ---
**Author:** ![yuxiao](https://avatars.discourse-cdn.com/v4/letter/y/ad7895/32.png) [@yuxiao](https://discuss.elastic.co/u/yuxiao)\ **Post date:** [December 11, 2018, 10:44am UTC](https://discuss.elastic.co/t/about-logstash-date-time-zone-questions/159631/8 "2018-12-11T10:44:57Z")
I can use another way solve the timezone problem,but that way is so complex. I want use simple way. [https://discuss.elastic.co/uploads/short-url/a93ng1fxTCS3eJCGpJ3tCt6kFGV.png](https://discuss.elastic.co/uploads/short-url/a93ng1fxTCS3eJCGpJ3tCt6kFGV.png) ---
**Author:** ![admlko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/admlko/32/21787_2.png) [@admlko](https://discuss.elastic.co/u/admlko)\ **Post date:** [December 11, 2018, 10:52am UTC](https://discuss.elastic.co/t/about-logstash-date-time-zone-questions/159631/9 "2018-12-11T10:52:11Z")
Ah okay, now I think I understood. Right, you know better about the timestamp format. The date filter in logstash ALWAYS converts to the UTC time. Now what you want, is to have a field which has the timestamp in your own timezone. This is not possible with the date filter and your only option is to use the ruby filter, as you have already done. If this is what you want, you can also check [my other reply about the same issue](https://discuss.elastic.co/t/timestamp-field-with-local-timezone/160238/2?u=admlko). ---
**Author:** ![yuxiao](https://avatars.discourse-cdn.com/v4/letter/y/ad7895/32.png) [@yuxiao](https://discuss.elastic.co/u/yuxiao)\ **Post date:** [December 11, 2018, 11:00am UTC](https://discuss.elastic.co/t/about-logstash-date-time-zone-questions/159631/10 "2018-12-11T11:00:19Z")
Yes, the link i readed just now. I used ruby filter solve this problem for now, thanks anyway! ---
**Author:** ![Petr.Simik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/petr.simik/32/38082_2.png) [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Post date:** [December 11, 2018, 1:12pm UTC](https://discuss.elastic.co/t/about-logstash-date-time-zone-questions/159631/11 "2018-12-11T13:12:26Z")
Within logstash filter you have specified timezone of source data . In case of source data (mysql) are in localtime (asia/shanghai) , your setup is correct timezone=\>"Asia/Shanghai" Now you have the data in elasticsearch index inserted correctly Now you you need to display the data how do you query the data ? in case you are using KIBANA you go to KIBANA-\>management-\>Kibana / Advanced Setting-\> Timezone for date formatting =\> select Asia/Shanghai so you will see the data correctly in format you need. ---
**Author:** ![yuxiao](https://avatars.discourse-cdn.com/v4/letter/y/ad7895/32.png) [@yuxiao](https://discuss.elastic.co/u/yuxiao)\ **Post date:** [December 12, 2018, 8:12am UTC](https://discuss.elastic.co/t/about-logstash-date-time-zone-questions/159631/12 "2018-12-12T08:12:20Z")
I used the Elasticsearch data by Service, like Java,if Elasticsearch show wrong, all Service read the wrong data. ---
**Author:** ![admlko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/admlko/32/21787_2.png) [@admlko](https://discuss.elastic.co/u/admlko)\ **Post date:** [December 12, 2018, 8:22am UTC](https://discuss.elastic.co/t/about-logstash-date-time-zone-questions/159631/13 "2018-12-12T08:22:17Z")
Usually it is best to store the data in UTC, so it will be easy to convert into different timezones later on in presentation layer (kibana, any other service using the data). But in some cases I understand that this is not viable - especially if you have lots of legacy software using it. As stated before, if you really need to store the data in a specific timezone, you need to use the Ruby filter which you have done 🙂 Cheers! ---
**Author:** ![yuxiao](https://avatars.discourse-cdn.com/v4/letter/y/ad7895/32.png) [@yuxiao](https://discuss.elastic.co/u/yuxiao)\ **Post date:** [December 13, 2018, 4:53am UTC](https://discuss.elastic.co/t/about-logstash-date-time-zone-questions/159631/14 "2018-12-13T04:53:41Z")
Thanks very much，I don't want to be interwined with this problem any more, just using Ruby, thanks again! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 10, 2019, 4:53am UTC](https://discuss.elastic.co/t/about-logstash-date-time-zone-questions/159631/15 "2019-01-10T04:53:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.