# Confused about timezone settings

**URL:** <https://discuss.elastic.co/t/confused-about-timezone-settings/165027>\
**Category:** Logstash\
**Created:** [January 21, 2019, 10:23am UTC](https://discuss.elastic.co/t/confused-about-timezone-settings/165027 "2019-01-21T10:23:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![fribse](https://avatars.discourse-cdn.com/v4/letter/f/c67d28/32.png) [@fribse](https://discuss.elastic.co/u/fribse)\
**Post date:** [January 21, 2019, 10:23am UTC](https://discuss.elastic.co/t/confused-about-timezone-settings/165027/1 "2019-01-21T10:23:11Z")

</div>

Hi Guys

I have bunch of servers that has logfiles shown in danish local time, which currently is UTC+1.  
The filebeat on the server where it harvest the logfile does NOT have a timezone set in the config.  
In the logstash I have this set up:

```
date {
        match => ["Time", "MM/dd/yyyy HH:mm:ss aa", "M/d/yyyy HH:mm:ss aa", "M/d/yyyy H:m:ss aa", "dd-MM-yyyy HH:mm:ss", "d-M-yyyy HH:mm:ss", "MM/dd/yyyy", "M/d/yyyy", "dd-MM-yyyy", "d-M-yyyy"]
        timezone => "Europe/Copenhagen"
}

```

When I look in Kibana it is shown like this (for an event occuring at 9:39 local time):

```
{
  "_index": "portraitcounting-6.5.1-2019.01",
...
    "@timestamp": "2019-01-21T09:39:27.975Z",
    "message": " 2019-01-21 9:39:27.975 10B8 [ZULU -] Sent 5 messages in transaction 1 on output channel 1001, queue 5",
...
  "fields": {
    "@timestamp": [
      "2019-01-21T09:39:27.975Z"
    ]
...
}

```

When viewed in Kibana it then shows 10:39

Shouldn't the timestamp be 8:39 because it is in Zulu time (UTC), and then with the locale set in the browser, it should be changed to 9:39?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 21, 2019, 10:38am UTC](https://discuss.elastic.co/t/confused-about-timezone-settings/165027/2 "2019-01-21T10:38:28Z")

</div>

What is the content of the `Time` field you are matching against? The timestamp in the `message` field does not seem to match the formats you have specified in the `date` filter. How come? Why not solve this by deploying Filebeat on the hosts where the data is being generated?

---

<div class="post-metadata">

**Author:** ![fribse](https://avatars.discourse-cdn.com/v4/letter/f/c67d28/32.png) [@fribse](https://discuss.elastic.co/u/fribse)\
**Post date:** [January 21, 2019, 10:44am UTC](https://discuss.elastic.co/t/confused-about-timezone-settings/165027/3 "2019-01-21T10:44:56Z")

</div>

Sorry, please forget the above date matching, it was the wrong filter, thus the wrong format, and the wrong date match.  
The right filter did not have a timezone line added, so I did that.  
Thankyou for pointing out the problem (sort of anyways 😃 )

---

<div class="post-metadata">

**Author:** ![fribse](https://avatars.discourse-cdn.com/v4/letter/f/c67d28/32.png) [@fribse](https://discuss.elastic.co/u/fribse)\
**Post date:** [January 21, 2019, 11:28am UTC](https://discuss.elastic.co/t/confused-about-timezone-settings/165027/5 "2019-01-21T11:28:31Z")

</div>

Ok, so it seems that it doesn't hit the mark still.

The correct filter looks like this:

```
grok {
  match => {
     "message" => [ "^ %{NOTSPACE:date}%{SPACE}%{NOTSPACE:clock} ...

```

...

```
mutate {
  add_field => {
    "datetime" => "%{date} %{clock}"

```

...

```
date {
  match => ["datetime", "yyyy-MM-dd H:mm:ss.SSS", "yyyy-MM-dd HH:mm:ss.SSS"]
  timezone => "Europe/Copenhagen"
 }

```

The JSON looks like this:

```
"@timestamp": "2019-01-21T11:23:44.510Z",
"message": " 2019-01-21 11:23:44.510 12C0 [TAXILA -] Sent 1 messages in transaction 1 on output channel 1001, queue 6",
...
"@timestamp": [
  "2019-01-21T11:23:44.510Z"

```

Oh, and I do have filebeat deployed on the 'source' server.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 18, 2019, 11:28am UTC](https://discuss.elastic.co/t/confused-about-timezone-settings/165027/6 "2019-02-18T11:28:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.