# Date Custom Field Timezone
**URL:** https://discuss.elastic.co/t/date-custom-field-timezone/108673
**Category:** Logstash
**Created:** [November 22, 2017, 8:52am UTC](https://discuss.elastic.co/t/date-custom-field-timezone/108673 "2017-11-22T08:52:12Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@MaikLinnemann](https://discuss.elastic.co/u/MaikLinnemann)
#### Post date: [November 22, 2017, 8:52am UTC](https://discuss.elastic.co/t/date-custom-field-timezone/108673/1 "2017-11-22T08:52:12Z")
Dear Forum,
i have a config which is as follows:
filter {
```
if [type] == "nginx-default" {
grok {
patterns_dir => "/etc/logstash/patterns"
match => ["message", "%{COMBINEDAPACHELOG}"]
}
date {
match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss +0100"]
timezone => "CET"
target => "logdatetime"
}
```
}
When i look for example into Kibana Table, i see:
Thats correct, as the Date/Time is the same as from the origin message! But when i look into JSON i get a value which differs exact an hour:
I believe its something about timezone or such. Can anyone help to get the correct values also in the JSON view!? I dont want to correct the values in kibana for view or fields, i want to have the values corrected with logstash, while its pushed into elastic, as i process the data later.
Thanks in advance,
regards
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 22, 2017, 9:06am UTC](https://discuss.elastic.co/t/date-custom-field-timezone/108673/2 "2017-11-22T09:06:29Z")
`@timestamp` is always UTC. This isn't configurable.
---
### Author:  [@MaikLinnemann](https://discuss.elastic.co/u/MaikLinnemann)
#### Post date: [November 22, 2017, 9:22am UTC](https://discuss.elastic.co/t/date-custom-field-timezone/108673/3 "2017-11-22T09:22:05Z")
Well, ok, but how shoould i understand those:
@Timestamp UTC:
timestamp ETC:
logdatetime UTC:
Is there no way to have logdatetime in ETC?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 22, 2017, 9:55am UTC](https://discuss.elastic.co/t/date-custom-field-timezone/108673/4 "2017-11-22T09:55:08Z")
You'd have to use a ruby filter. I think examples of that have been posted in the past.
---
### Author:  [@MaikLinnemann](https://discuss.elastic.co/u/MaikLinnemann)
#### Post date: [November 22, 2017, 2:07pm UTC](https://discuss.elastic.co/t/date-custom-field-timezone/108673/5 "2017-11-22T14:07:08Z")
Hey Magnus,
i know there are examples but i cant get it to work. Can you give a hint why this is not working:
date {
match =\> ["timestamp", "dd/MMM/yyyy:HH:mm:ss +0100"]
target =\> "tempdate"
}
```
ruby {
code => "event.set('logdatetime', event.get('tempdate').time.strftime('%Y-%m-%dT%H:%M:%S +0100'))"
}
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 22, 2017, 2:11pm UTC](https://discuss.elastic.co/t/date-custom-field-timezone/108673/6 "2017-11-22T14:11:56Z")
You need to convert the timestamp to the local timezone. I don't know OTOH how to do that. Perhaps
```nohighlight
t = event.get('tempdate').time
t.localtime('+01:00')
event.set('logdatetime', t.strftime('%Y-%m-%dT%H:%M:%S +0100'))
```
works.
---
### Author:  [@MaikLinnemann](https://discuss.elastic.co/u/MaikLinnemann)
#### Post date: [November 22, 2017, 3:10pm UTC](https://discuss.elastic.co/t/date-custom-field-timezone/108673/7 "2017-11-22T15:10:53Z")
Works. Made my Day, thanks. For someone else:
```
date {
match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss +0100"]
target => "tempdate"
}
ruby {
code => "
t = event.get('tempdate').time
t.localtime('+01:00')
event.set('logdatetime', t.strftime('%Y-%m-%dT%H:%M:%S +0100'))
"
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 20, 2017, 3:11pm UTC](https://discuss.elastic.co/t/date-custom-field-timezone/108673/8 "2017-12-20T15:11:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.