# Creation date of logstash created files, with %{+YYYY.MM.dd} in the name, is offset by few hours
**URL:** https://discuss.elastic.co/t/creation-date-of-logstash-created-files-with-yyyy-mm-dd-in-the-name-is-offset-by-few-hours/385002
**Category:** Logstash
**Created:** [February 11, 2026, 6:30am UTC](https://discuss.elastic.co/t/creation-date-of-logstash-created-files-with-yyyy-mm-dd-in-the-name-is-offset-by-few-hours/385002 "2026-02-11T06:30:18Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Toxic\_Bunny](https://discuss.elastic.co/u/Toxic_Bunny)
#### Post date: [February 11, 2026, 6:30am UTC](https://discuss.elastic.co/t/creation-date-of-logstash-created-files-with-yyyy-mm-dd-in-the-name-is-offset-by-few-hours/385002/1 "2026-02-11T06:30:18Z")
Logstash sends all unprocessed leftovers into a separate .log file for archiving purposes
`output{`
`file {`
`path => "/var/log/logstash/archive-%{+YYYY.MM.dd}.log"`
`}`
`}`
The problem is that logstash additionally offsets the date (at least I assume it does) by my timezone (Etc/GMT-5, +5:00), so instead of starting to write in the new file at midnight it only does so at 5 in the morning.
Is it possible to add manual offset by minus 5 hours or I have to add usage of ruby in the config file to receive local time and use it for the name instead?
---
### Author:  [@RainTown](https://discuss.elastic.co/u/RainTown)
#### Post date: [February 11, 2026, 10:32am UTC](https://discuss.elastic.co/t/creation-date-of-logstash-created-files-with-yyyy-mm-dd-in-the-name-is-offset-by-few-hours/385002/2 "2026-02-11T10:32:36Z")
> [@Toxic\_Bunny](#):
>
> `file {`
> `path => "/var/log/logstash/archive-%{+YYYY.MM.dd}.log"`
> `}`
This is UTC.
You can do an offset, but it's a little bit hacky via a filter. Consider (I used per-hour, just take away the `.%H` / `.HH` to make it per day)
```auto
# echo '{"message":"test from bash"}' > /dev/tcp/localhost/5514
# ls -ltr /var/log/logstash/logstash-archive-*
-rw-r--r-- 1 logstash logstash 118 Feb 11 11:28 /var/log/logstash/logstash-archive-utctime-2026.02.11.10.log
-rw-r--r-- 1 logstash logstash 118 Feb 11 11:28 /var/log/logstash/logstash-archive-loctime-2026.02.11.11.log
# date
Wed Feb 11 11:29:21 AM CET 2026
# date --utc
Wed Feb 11 10:29:30 AM UTC 2026
# cat /etc/logstash/conf.d/pipeline.conf
input {
tcp {
port => 5514
codec => json
}
}
filter {
ruby {
code => "
t = event.get('@timestamp').time.localtime
event.set('index_day', t.strftime('%Y.%m.%d.%H'))
"
}
}
output {
file {
path => "/var/log/logstash/logstash-archive-utctime-%{+YYYY.MM.dd.HH}.log"
}
file {
path => "/var/log/logstash/logstash-archive-loctime-%{index_day}.log"
}
}
# cat /var/log/logstash/logstash-archive-utctime-2026.02.11.10.log
{"@timestamp":"2026-02-11T10:28:58.245362535Z","index_day":"2026.02.11.11","message":"test from bash","@version":"1"}
# cat /var/log/logstash/logstash-archive-loctime-2026.02.11.11.log
{"@timestamp":"2026-02-11T10:28:58.245362535Z","index_day":"2026.02.11.11","message":"test from bash","@version":"1"}
```
---
### Author:  [@Toxic\_Bunny](https://discuss.elastic.co/u/Toxic_Bunny)
#### Post date: [February 12, 2026, 3:27am UTC](https://discuss.elastic.co/t/creation-date-of-logstash-created-files-with-yyyy-mm-dd-in-the-name-is-offset-by-few-hours/385002/3 "2026-02-12T03:27:07Z")
So I do have to add block for ruby… Ah well, cheers
cramped both lines into one event.set, Logstash is seemingly unhappy with ruby having it’s own variables
`event.set('index_date', event.get('@timestamp').time.localtime.strftime('%Y.%m.%d')`
---
### Author:  [@SteveJR1](https://discuss.elastic.co/u/SteveJR1)
#### Post date: [February 22, 2026, 2:29pm UTC](https://discuss.elastic.co/t/creation-date-of-logstash-created-files-with-yyyy-mm-dd-in-the-name-is-offset-by-few-hours/385002/4 "2026-02-22T14:29:00Z")
What’s happening is that `%{+YYYY.MM.dd}` uses the event’s `@timestamp`, and that timestamp is in **UTC** by default. So your file rollover is based on UTC midnight, not your local time — that’s why it switches around 5 AM for you. You don’t need Ruby for this.
The cleaner fix is to make sure the event timestamp is converted to your local timezone before the file output runs. You can do that with the `date` filter by setting the timezone properly when parsing the timestamp, or by adjusting `@timestamp` to your local zone.
Another option (simpler if this is just for file naming) is to set Logstash’s JVM timezone to your local timezone instead of UTC. You can do that by adding:
```auto
-Duser.timezone=Etc/GMT-5
```
to your Logstash JVM options and restarting the service. That way, the date pattern in the filename will roll over at your local midnight instead of UTC. So no, you don’t need Ruby — just align Logstash’s timezone handling with your local time.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [February 22, 2026, 3:28pm UTC](https://discuss.elastic.co/t/creation-date-of-logstash-created-files-with-yyyy-mm-dd-in-the-name-is-offset-by-few-hours/385002/5 "2026-02-22T15:28:31Z")
Hello and welcome,
> [@SteveJR1](#):
>
> Another option (simpler if this is just for file naming) is to set Logstash’s JVM timezone to your local timezone instead of UTC. You can do that by adding:
>
> ```auto
> -Duser.timezone=Etc/GMT-5
>
> ```
>
> to your Logstash JVM options and restarting the service. That way, the date pattern in the filename will roll over at your local midnight instead of UTC. So no, you don’t need Ruby — just align Logstash’s timezone handling with your local time.
Just as information, this does not work, the `@timestamp` field in Logstash will **always** be in UTC, it doesn't matter if you change the timezone of the server or the process, it will always convert it to UTC.
In this case, the ruby approach is the way to create files with the date and/or time in local time.