Date filter and time zone transition

[simonhoenscheid (Simon)]

Hey there,

I'm a bit confused how the date filter is working.

I have a logstash config which is parsing cloudfront logs from an s3 input. which is working really nice. the timestamp in the logfile is UTC. So I added this information in a seperate field and try to parse it. Exspecting the timestamp field will show the time in Europe/Berlin time now, which would add 2 hours.
Can somebody explain where my fault is?

mutate {
add_field => {
"cloudfront_logdate" => "%{date} %{time} UTC"
}
}

date {
match => [ "cloudfront_logdate" , "yy-MM-dd HH:mm:ss ZZZ" ]
timezone => "Europe/Berlin"
}

Output:

"@timestamp" => 2017-06-05T10:13:13.000Z,
"cloudfront_logdate" => "17-06-05 10:13:13 UTC"

Thx for help
Simon

[jsvd (João Duarte)]

the date filter will always convert timestamps to UTC.

The timezone => setting is used to indicate timezone of the original timestamp, which is only necessary if the timestamp format does not specify a timezone, like 2017-12-04 08:00:00 (YYYY-MM-dd HH:mm:ss). In this example, setting timezone to Europe/Berlin, makes logstash convert 2017-12-04 08:00:00 to 2017-12-04T07:00:00.000Z