# Convert datetime to another timezone in logstash

**URL:** https://discuss.elastic.co/t/convert-datetime-to-another-timezone-in-logstash/336214
**Category:** Logstash
**Created:** [June 16, 2023, 11:50am UTC](https://discuss.elastic.co/t/convert-datetime-to-another-timezone-in-logstash/336214 "2023-06-16T11:50:11Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![ashokkrishna99\_Vemur](https://avatars.discourse-cdn.com/v4/letter/a/d9b06d/32.png) [@ashokkrishna99\_Vemur](https://discuss.elastic.co/u/ashokkrishna99_Vemur)
#### Post date: [June 16, 2023, 11:50am UTC](https://discuss.elastic.co/t/convert-datetime-to-another-timezone-in-logstash/336214/1 "2023-06-16T11:50:11Z")

</div>

I am getting logs from a firewall which are in GMT timezone. For example firewall sending **rt=Jun 16 2023 11:24:40 GMT** I want to convert that time to MYT **rt=June 16 2023 19:24:40 MYT**.

How can I do that.

```auto
filter {
grok{
match => {"message" => "%{TIMESTAMP_ISO8601:Timestamp} %{SYSLOGHOST:DeviceName} CEF: %{INT:CEF_Version}\|(?<DeviceVendor>\w.*)\|(?<DeviceProduct>\w+-\w+)\|(?<DeviceVersion>\d+\.\d+\.\d+)\|(?<LogSubType>\b\w+(?:-\w+)?\b)\|%{WORD:LogType}\|%{INT:Severity}\|rt=(?<ReceiptTime>%{MONTH} %{MONTHDAY} %{YEAR} %{TIME} %{WORD}) %{GREEDYDATA:extensions}"}
ecs_compatibility => disabled
}}

```

Here the field holding GMT time is "ReceiptTime"

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [June 16, 2023, 12:58pm UTC](https://discuss.elastic.co/t/convert-datetime-to-another-timezone-in-logstash/336214/2 "2023-06-16T12:58:16Z")

</div>

> [@ashokkrishna99\_Vemur](#):
>
> How can I do that.

You can't, all datetime fields in Logstash and Elasticsearch are in UTC and this cannot be changed.

Kibana will convert the UTC dates to your current timezone.

---

<div class="post-metadata">

### Author: ![ashokkrishna99\_Vemur](https://avatars.discourse-cdn.com/v4/letter/a/d9b06d/32.png) [@ashokkrishna99\_Vemur](https://discuss.elastic.co/u/ashokkrishna99_Vemur)
#### Post date: [June 16, 2023, 3:17pm UTC](https://discuss.elastic.co/t/convert-datetime-to-another-timezone-in-logstash/336214/3 "2023-06-16T15:17:46Z")

</div>

I am not sending data to kibana or elasticsearch. I am sending them to seperate destination. In some other post i observed Ruby code filter can change the timezone and time value ?

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [June 16, 2023, 3:22pm UTC](https://discuss.elastic.co/t/convert-datetime-to-another-timezone-in-logstash/336214/4 "2023-06-16T15:22:14Z")

</div>

> [@ashokkrishna99\_Vemur](#):
>
> In some other post i observed Ruby code filter can change the timezone and time value ?

Yeah, you would probably need to write a ruby code using the ruby filter to convert it them, Logstash date filter can only convert into UTC, not to other time zones.

Not sure what the code would like, but there are some examples in the forum.

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [June 16, 2023, 3:33pm UTC](https://discuss.elastic.co/t/convert-datetime-to-another-timezone-in-logstash/336214/5 "2023-06-16T15:33:52Z")

</div>

This [forum post](https://discuss.elastic.co/t/converting-timezones-in-logstash-howto/333821) is probably similar to what you want.

---

<div class="post-metadata">

### Author: ![ashokkrishna99\_Vemur](https://avatars.discourse-cdn.com/v4/letter/a/d9b06d/32.png) [@ashokkrishna99\_Vemur](https://discuss.elastic.co/u/ashokkrishna99_Vemur)
#### Post date: [June 16, 2023, 6:41pm UTC](https://discuss.elastic.co/t/convert-datetime-to-another-timezone-in-logstash/336214/6 "2023-06-16T18:41:01Z")

</div>

No. It's not

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [June 16, 2023, 7:10pm UTC](https://discuss.elastic.co/t/convert-datetime-to-another-timezone-in-logstash/336214/7 "2023-06-16T19:10:10Z")

</div>

> [@ashokkrishna99\_Vemur](#):
>
> No. It's not

Well, then you will need to try to create a ruby code using the ruby filter to achieve what you want.

---

<div class="post-metadata">

### Author: ![ashokkrishna99\_Vemur](https://avatars.discourse-cdn.com/v4/letter/a/d9b06d/32.png) [@ashokkrishna99\_Vemur](https://discuss.elastic.co/u/ashokkrishna99_Vemur)
#### Post date: [June 16, 2023, 7:40pm UTC](https://discuss.elastic.co/t/convert-datetime-to-another-timezone-in-logstash/336214/8 "2023-06-16T19:40:47Z")

</div>

I found the solution

```auto
filter {
  date {
    match => ["timestamp1", "MMM dd yyyy HH:mm:ss z"]
    target => "converted_date"
    timezone => "GMT"
  }

  ruby {
    code => "
      event.set('converted_date', event.get('converted_date').time.localtime('+08:00').strftime('%b %d %Y %H:%M:%S MYT'))
    "
  }
}

```

this code helps me

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 16, 2023, 8:06pm UTC](https://discuss.elastic.co/t/convert-datetime-to-another-timezone-in-logstash/336214/9 "2023-06-16T20:06:33Z")

</div>

You can do it in ruby.

```
    mutate { add_field => { "rt" => "Jun 16 2023 11:24:40 GMT" } }
    date { match => ["rt", "MMM dd YYYY HH:mm:ss ZZZ"] }

    ruby {
        code => '
            t = event.get("[@timestamp]").to_f
            t = Time.at(t, in: "+08:00")
            event.set("localtime", t.strftime("%b %d %Y %H:%M:%S MYT"))
        '
    }

```

will produce

```
 "localtime" => "Jun 16 2023 19:24:40 MYT",
"@timestamp" => 2023-06-16T11:24:40.000Z,

```

I don't think core Ruby has enough timezone support to avoid specifying both the offset and the name of MYT.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 14, 2023, 8:07pm UTC](https://discuss.elastic.co/t/convert-datetime-to-another-timezone-in-logstash/336214/10 "2023-07-14T20:07:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
