thank you. I have tried as your said. Athough no exception happens, the 'snapTime' filed still retainutc format rather than my local time zone.
The filter as follows:
filter{
ruby{
init => 'require "time"'
code => "event.set('snapTime',Time.parse(event.get('snapTime')).localtime('+08:00'))"
}
}
The rubydebug stdout as follows:
{
"snapTime" => 2019-01-10T02:39:12.000Z,
"@version" => "1",
"@timestamp" => 2019-01-15T07:22:59.390Z,
"name" => "wangqh"
}
the field 'snapTime' still retain '2019-01-10T02:39:12.000Z' rather than '2019-01-10T10:39:12.000+08:00'