Convert data from UTC to localtime "Europe/Warsaw"

Elastic Stack Logstash
1

Hello,

I'm trying to convert UTC time to my timezone "Europe/Warsaw" in logstash pipeline but it didnt work. This is my filter in pipeline:

filter {
  date {
    match => ["[fields][timestamp]", "ISO8601", "UNIX_MS"]
    target => "event_time"
    timezone => "Europe/Warsaw"
  }
}

image
image747×247 22.8 KB

i've changed the timzone in Advanced Settings but it depends only on @timestamp.

Greetings

2

A date filter in logstash always converts a date to UTC, if the string being converted specifies the timezone then the timezone option is ignored. (See also here.) You can convert it to the local timezone in the presentation layer (e.g. Kibana).

If you want to create a string in a local timezone in logstash then see here.

3

Thanks, a lot.

I've did something like that and its work perfecly. By the way in the time.localtime we dont need to specify any time and it will by always our localtime.

In that case i dont know if that "timezone => "Europe/Warsaw" doing something but i will keep it in my pipeline.

filter {
  date {
    match => ["[fields][timestamp]", "ISO8601", "UNIX_MS"]
    target => "event_time"
    timezone => "Europe/Warsaw"
  }
  ruby {
    code => "
      event.set('event_time', event.get('event_time').time.localtime.strftime('%Y-%m-%d %H:%M:%S:%L'))
    "
  }
}

Theres is documentation about vars you can add into strftime:
strftime_formatting - Documentation for Ruby 3.5

Greetings