Add hours and replace @timestamp

Elastic Stack Logstash
1

Elasticsearch 1.7.1
Logstash 1.5.4

I use below syslog's logstash config. When i run logstash,error occurred.
***"logstash ruby exception occurred undefined method localtime"***. How can i fix it?

configuration file for Logstash + syslog, called logstash-syslog.conf.
input {
tcp {
port => 5000
type => syslog
}
udp {
port => 5000
type => syslog
}
}

filter {
ruby {
code => "
event['@timestamp'] = event['@timestamp'].localtime('+09:00')
"
}
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:[%{POSINT:syslog_pid}])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}

output {
elasticsearch { host => localhost }
stdout { codec => rubydebug }
}

2

Any reason you are changing timestamp and not just creating a different TZ specific field?
The entire ELK stack works on UTC so changing a core field like this is not recommended.

3

I knew ELK works on UTC. I have a problem of logstash index name daily. logstash index's format is logstash-yyyymmdd.
Because of UTC delay time,index name also is delayed. index logstash-2015-09-06 has both 09-05 and 09-06. Is there a way to fix it with kibana timezone?

4

I'd suggest you just leave it.
Kibana will automatically translate the UTC times into local ones (and vice versa).

5

Ok. Thanks a lot for your reply.