# Add hours and replace @timestamp
**URL:** https://discuss.elastic.co/t/add-hours-and-replace-timestamp/28730
**Category:** Logstash
**Created:** [September 6, 2015, 12:20am UTC](https://discuss.elastic.co/t/add-hours-and-replace-timestamp/28730 "2015-09-06T00:20:10Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@colormegood](https://discuss.elastic.co/u/colormegood)
#### Post date: [September 6, 2015, 12:20am UTC](https://discuss.elastic.co/t/add-hours-and-replace-timestamp/28730/1 "2015-09-06T00:20:10Z")
Elasticsearch 1.7.1
Logstash 1.5.4
I use below syslog's logstash config. When i run logstash,error occurred.
\*\*\*"logstash ruby exception occurred undefined method localtime"\*\*\*. How can i fix it?
configuration file for Logstash + syslog, called logstash-syslog.conf.
input {
tcp {
port =\> 5000
type =\> syslog
}
udp {
port =\> 5000
type =\> syslog
}
}
filter {
ruby {
code =\> "
event['@timestamp'] = event['@timestamp'].localtime('+09:00')
"
}
if [type] == "syslog" {
grok {
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }
add\_field =\> ["received\_at", "%{@timestamp}"]
add\_field =\> ["received\_from", "%{host}"]
}
syslog\_pri { }
date {
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}
}
}
output {
elasticsearch { host =\> localhost }
stdout { codec =\> rubydebug }
}
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 6, 2015, 12:27am UTC](https://discuss.elastic.co/t/add-hours-and-replace-timestamp/28730/2 "2015-09-06T00:27:41Z")
Any reason you are changing timestamp and not just creating a different TZ specific field?
The entire ELK stack works on UTC so changing a core field like this is not recommended.
---
### Author:  [@colormegood](https://discuss.elastic.co/u/colormegood)
#### Post date: [September 6, 2015, 12:57am UTC](https://discuss.elastic.co/t/add-hours-and-replace-timestamp/28730/3 "2015-09-06T00:57:09Z")
I knew ELK works on UTC. I have a problem of logstash index name daily. logstash index's format is logstash-yyyymmdd.
Because of UTC delay time,index name also is delayed. index logstash-2015-09-06 has both 09-05 and 09-06. Is there a way to fix it with kibana timezone?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 6, 2015, 12:59am UTC](https://discuss.elastic.co/t/add-hours-and-replace-timestamp/28730/4 "2015-09-06T00:59:20Z")
I'd suggest you just leave it.
Kibana will automatically translate the UTC times into local ones (and vice versa).
---
### Author:  [@colormegood](https://discuss.elastic.co/u/colormegood)
#### Post date: [September 6, 2015, 1:02am UTC](https://discuss.elastic.co/t/add-hours-and-replace-timestamp/28730/5 "2015-09-06T01:02:06Z")
Ok. Thanks a lot for your reply.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:29am UTC](https://discuss.elastic.co/t/add-hours-and-replace-timestamp/28730/6 "2017-07-06T05:29:55Z")