Convert timezone of @timestamp field

The trailing Z says the date is UTC, so the timezone option is ignored. Use mutate+gsub to remove it.

mutate { gsub => [ "new_timestamp", "Z$", "" ] }
1 Like