Daily index name and @timestamp value discrepancies

Elastic Stack Logstash
1

Hello,

As many here, we use logstash to fill in data in ES and the output is a daily index with this format:
index-name-%{+YYYY.MM.dd}

Yesterday (2016.03.01) , I saw a few a hours before midnight the next day index (today: 2016.03.02) appearing. But when viewing data in this new index, I saw data with the current day?

So, why the «March 1st 2016, 21:21» event is in the XXXXXX-2016.03.02 index?

Screenshot:

Thanks
Bruno Lavoie

2

The index names are based on UTC dates while the timestamp you see in Kibana by default it browser local time.

3

ha! so sorry I didn't thought of this detail.

So when we launch a query in Kibana, is he intelligent and use correctly date pattern accordingly?
I think it's yes...

Thanks

4

Yes, Kibana will of course do the right thing here.