Add extra timestamp field for local time

[kernelpanic (FreeBSD user)]

Hello, I understand that Elasticsearch stores timestamp in UTC format internally, which are an hour behind my local time (UK time). I would like to add a field that shows the correct local time, am I right in thinking I need to do something with a Ruby filter as in this post:

Convert @timestamp to epoch

Hi, I need to convert @timestamp to epoch and add this new field to the event. So far I can only add a new field with the content of "@timestamp". filter { mutate { add_field => ["epochtime", "%{@timestamp}"] } } I'm sure this will be an easy fix although I can't find anything to lead me to my answer. Please assist. Thank you, Rivaan

...or is there a simpler way to do it?

Thanks.

[kernelpanic (FreeBSD user)]

I think the code would be something like:

filter {
    ruby {
        code => "event['local_time'] = event['@timestamp'].localtime('+01:00')"
    }
}

But I'm unsure how to get that value in a new field