Hello everyone, My goal is export alerts from elasticsearch and I have 2 problems left to solve: My current configuration: input { elasticsearch { hosts => "https://ip:9200" index => ".internal.alerts-security.alerts-default-*" user => "user" password => "pass" ssl_certifica…

OK, so you need to tweak the ruby code slightly input { generator { count => 1 lines => [ '{ "@timestamp": "2024-06-11T14:58:20.420Z" }' ] codec => json } } output { stdout { codec => rubydebug { metadata => false } } } filter { ruby { code => ' t = event.get("[@timestamp]"…

[image] gbL2k: How can I convert the default @timestamp (UTC) field coming from elastic to my timezone? There is an example of that here .

Can you exaplain what it does? For my understanding it just creates an rt field and sets the localtime with a value +8 hours from that date.

[image] gbL2k: For my understanding it just creates an rt field and sets the localtime with a value +8 hours from that date. That's right. If a document has an [rt] field in UTC it creates another field in localtime (provided localtime is MYT -- it would have to be adjusted for other local ti…

My goal is to have a field that contains the timestamp coming from the @timestamp field(utc) in my local timezone gmt+2. I made some changes to the configuration,it creates the timestamp_zoned field but the date is the same as in the original @timestamp field. : filter { mutate { add…

[image] gbL2k: date { match => [ "timestamp_zoned", "yyyy-MM-dd HH:mm:ss'Z'" ] timezone => "Europe/Budapest" target => "timestamp_zoned" } The Z at the end of the [timestamp_zoned] indicates it is in Zulu (UTC). The timezone option on the date filter is ignored…

Thanks for the information I didnt know that. I removed it but nothing changed :frowning: .

Any idea? I have none, I tried everything I could find to solve this problem.

[image] gbL2k: I tried everything I could find to solve this problem What exactly is the problem? You described an issue and I provided a link to what I thought was a solution. If it is not a solution then I need a better problem definition.

I receive a UTC timestamp from elastic in the @timestamp field. My goal is to create a new field from that timestamp field in my timezone(GMT+2). For example: I have the following the document that is coming from ES. "@timestamp": [ "2024-06-11T14:58:20.420Z" ], I want to have a f…

Discuss the Elastic Stack

Convert the default ES UTC time to local timezone with logstash

Elastic Stack Logstash

Badger June 21, 2024, 10:52am 2

There is an example of that here.

Topic		Replies	Views
Convert Elasticsearch Date/Time field from UTC To Local Time Logstash	9	5144	August 14, 2019
Convert timezone of @timestamp field Logstash	8	6252	January 30, 2020
Add extra timestamp field for local time Logstash	2	1587	May 23, 2017
Convert UNIX epoch to local time Logstash	6	4908	May 8, 2017
How to change time zone from Zulu Elasticsearch	5	2527	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Convert the default ES UTC time to local timezone with logstash

Related topics