# Convert Elasticsearch Date/Time field from UTC To Local Time?

**URL:** <https://discuss.elastic.co/t/convert-elasticsearch-date-time-field-from-utc-to-local-time/283441>\
**Category:** Elasticsearch\
**Created:** [September 6, 2021, 11:26am UTC](https://discuss.elastic.co/t/convert-elasticsearch-date-time-field-from-utc-to-local-time/283441 "2021-09-06T11:26:45Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![padamrai](https://avatars.discourse-cdn.com/v4/letter/p/3da27b/32.png) [@padamrai](https://discuss.elastic.co/u/padamrai)\
**Post date:** [September 6, 2021, 11:26am UTC](https://discuss.elastic.co/t/convert-elasticsearch-date-time-field-from-utc-to-local-time/283441/1 "2021-09-06T11:26:45Z")

</div>

I am getting 12 Hours difference in Date. I want to set that date format to local time that is GMT+5.  
And I have set kibana default time period to Browser. Any one can help me how to set is as local time.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 6, 2021, 12:18pm UTC](https://discuss.elastic.co/t/convert-elasticsearch-date-time-field-from-utc-to-local-time/283441/2 "2021-09-06T12:18:16Z")

</div>

Where are you getting this difference? In Kibana?

The date/time fields in elasticsearch are always stored in UTC and you can't change that, what you can change is the visualization.

Per default, Kibana will convert the UTC time to the browser time, but you can change that to convert to a specific timezone in the advanced settings, just search for timezone.

What you need to make sure is that you are ingesting the date and time fields correctly.

For example, if you have the time:

If you are in a timezone of UTC+5 (GMT+5) and you have the local time: `2021-09-06 09:10:15`, this time in UTC would be `2021-09-06 04:10:15`, since the date/time string doesn't have any timezone information, you can't simply ingest as `20210-09-06 09:10:15`, as elasticsearch will assume that this is the UTC time and when you visualize it in Kibana it will again convert to your local time adding +5 hours.

When ingesting you need to have your time converted to UTC before or you need to add timezone information to your date/time string, how to do that will depending on how you are ingesting your data.

Can you provide more information about how you are ingesting your data?

---

<div class="post-metadata">

**Author:** ![padamrai](https://avatars.discourse-cdn.com/v4/letter/p/3da27b/32.png) [@padamrai](https://discuss.elastic.co/u/padamrai)\
**Post date:** [September 6, 2021, 12:22pm UTC](https://discuss.elastic.co/t/convert-elasticsearch-date-time-field-from-utc-to-local-time/283441/3 "2021-09-06T12:22:29Z")

</div>

I have ReceivedOn field and I have targeted timestamp with this field in logstash like that

```auto
date{
        match=>["ReceivedOn", "MM/dd/yyyy HH:mm:ss a"]
        target => "@timestamp"
    }

```

This time goes back to 12 hours.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 6, 2021, 12:26pm UTC](https://discuss.elastic.co/t/convert-elasticsearch-date-time-field-from-utc-to-local-time/283441/4 "2021-09-06T12:26:59Z")

</div>

What is the value of the field `ReceivedOn` ? In which timezone is the value generated? Share an example of the date.

As I said if your date doesn't have a timezone in the format, you need to set it during ingestion, in logstash you can do that adding the option `timezone => "-XXXX"` which the difference from UTC, for example `timezone => "+0500"`, this tell logstash that the value of the field in the date filter is on the timezone UTC+5, so it will correctly convert to UTC.

---

<div class="post-metadata">

**Author:** ![padamrai](https://avatars.discourse-cdn.com/v4/letter/p/3da27b/32.png) [@padamrai](https://discuss.elastic.co/u/padamrai)\
**Post date:** [September 6, 2021, 12:35pm UTC](https://discuss.elastic.co/t/convert-elasticsearch-date-time-field-from-utc-to-local-time/283441/5 "2021-09-06T12:35:15Z")

</div>

"ReceivedOn":"9/6/2021 4:00:32 PM"  
My timezone is GMT+5

---

<div class="post-metadata">

**Author:** ![padamrai](https://avatars.discourse-cdn.com/v4/letter/p/3da27b/32.png) [@padamrai](https://discuss.elastic.co/u/padamrai)\
**Post date:** [September 6, 2021, 12:37pm UTC](https://discuss.elastic.co/t/convert-elasticsearch-date-time-field-from-utc-to-local-time/283441/6 "2021-09-06T12:37:47Z")

</div>

And Default timezone is Browser

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 6, 2021, 12:47pm UTC](https://discuss.elastic.co/t/convert-elasticsearch-date-time-field-from-utc-to-local-time/283441/7 "2021-09-06T12:47:20Z")

</div>

Try to use the following date filter, this will tell logstash that your date is in the UTC + 5 timezone.

Also, you don't need to set the `target` option if you want to store the result of the date filter in the `@timestamp` field, this is the default behaviour.

```auto
date{
        match=>["ReceivedOn", "MM/dd/yyyy HH:mm:ss a"]
        timezone => "+0500"
    }

```

---

<div class="post-metadata">

**Author:** ![padamrai](https://avatars.discourse-cdn.com/v4/letter/p/3da27b/32.png) [@padamrai](https://discuss.elastic.co/u/padamrai)\
**Post date:** [September 6, 2021, 12:53pm UTC](https://discuss.elastic.co/t/convert-elasticsearch-date-time-field-from-utc-to-local-time/283441/8 "2021-09-06T12:53:00Z")

</div>

I think it is getting confused with AM/PM, still graph showing 12hour difference, 6PM gives me 6AM.  
"ReceivedOn":"9/6/2021 6:00:00 PM", I have given this date and graphs on 6AM

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 6, 2021, 1:08pm UTC](https://discuss.elastic.co/t/convert-elasticsearch-date-time-field-from-utc-to-local-time/283441/9 "2021-09-06T13:08:03Z")

</div>

Oh, I see.

You can't use `HH` if you have `AM/PM` format set.

As you can see in the [joda-time documentation](https://www.joda.org/joda-time/key_format.html), `H` is used for the hour of day (0-23) and `h` is used to hour of halfday (1-12), which is your case.

Try to change `HH` to `hh`.

---

<div class="post-metadata">

**Author:** ![padamrai](https://avatars.discourse-cdn.com/v4/letter/p/3da27b/32.png) [@padamrai](https://discuss.elastic.co/u/padamrai)\
**Post date:** [September 6, 2021, 1:11pm UTC](https://discuss.elastic.co/t/convert-elasticsearch-date-time-field-from-utc-to-local-time/283441/10 "2021-09-06T13:11:52Z")

</div>

Thank You so much Sir for your precious time.  
You saved by life. 🥰

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 4, 2021, 1:12pm UTC](https://discuss.elastic.co/t/convert-elasticsearch-date-time-field-from-utc-to-local-time/283441/11 "2021-10-04T13:12:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.