Change existing timezone

Elastic Stack Logstash
1

Hi all,

We do have 2 datetime field named @Timestamp (which is UCT by default) and logdate (no timezone set, means default to UTC). Now we would like to map the logdate field to a specific timezone say canadian timezone, will elasticsearch store this in UTC? what will happen to our previous logdate data?

2

elasticsearch always stores dates in UTC. If you start setting a timezone on a date filter it will not affect documents that have already been indexed.

3

Thanks for the reply badger,

So what exactly happened is that, we do have a logdate field which is canada time (EDT), but since we havent put the timezone, it automatically stored as UTC by default. So what if we have this scenario.

1st ingest (no timezone specified): timestamp= 2:44 AM
2nd ingest (with timezone specified): timestamp= 6:44 AM

take note the original timestamp is 2:44 AM.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.