I don't use @timestamp. but I have own date-type field. The field name is execTime.
my datas only upload under offline.
For example, all the datas move to elastic server using USB memory and so on.
Recently I found the different between execTime value in kibana and in memory.
The cause is date field's timezone. The problem is solved using timezone setting in logstash.config.
ex.
date {
match => ["execTime", "yyyyMMddHHmm", "yyyyMMddHHmmss", "yyyy-MM-dd HH:mm:ss", "yyyy-MM-dd HH:mm:ss.SSS"]
timezone => "Asia/Seoul"
target => "execTime"
}
However, I found another problem.
The execTime is celular's local time. so timezone is various.
I want to set the date field considering different timezone.
I need your help.
In order to be considered the timezone you need to make sure the field execTime has the timezone information in it, otherwise it will use the timezone that you defined at Date timezone.
In this thread How to set @timestamp timezone? you can read a discussion about Logstash and Kibana timezone. It is suggested to convert all the timestamps in the UTC timezone.
Hope I could help you.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.