# Date filter and time zone transition

**URL:** <https://discuss.elastic.co/t/date-filter-and-time-zone-transition/91672>\
**Category:** Logstash\
**Created:** [July 3, 2017, 4:22pm UTC](https://discuss.elastic.co/t/date-filter-and-time-zone-transition/91672 "2017-07-03T16:22:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![simonhoenscheid](https://avatars.discourse-cdn.com/v4/letter/s/6de8d8/32.png) [@simonhoenscheid](https://discuss.elastic.co/u/simonhoenscheid)\
**Post date:** [July 3, 2017, 4:22pm UTC](https://discuss.elastic.co/t/date-filter-and-time-zone-transition/91672/1 "2017-07-03T16:22:36Z")

</div>

Hey there,

I'm a bit confused how the date filter is working.

I have a logstash config which is parsing cloudfront logs from an s3 input. which is working really nice. the timestamp in the logfile is UTC. So I added this information in a seperate field and try to parse it. Exspecting the timestamp field will show the time in Europe/Berlin time now, which would add 2 hours.  
Can somebody explain where my fault is?

mutate {  
add\_field =\> {  
"cloudfront\_logdate" =\> "%{date} %{time} UTC"  
}  
}

date {  
match =\> ["cloudfront\_logdate" , "yy-MM-dd HH:mm:ss ZZZ"]  
timezone =\> "Europe/Berlin"  
}

Output:

"@timestamp" =\> 2017-06-05T10:13:13.000Z,  
"cloudfront\_logdate" =\> "17-06-05 10:13:13 UTC"

Thx for help  
Simon

---

<div class="post-metadata">

**Author:** ![jsvd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsvd/32/6203_2.png) [@jsvd](https://discuss.elastic.co/u/jsvd)\
**Post date:** [July 3, 2017, 5:50pm UTC](https://discuss.elastic.co/t/date-filter-and-time-zone-transition/91672/2 "2017-07-03T17:50:57Z")

</div>

the date filter will always convert timestamps to UTC.

The `timezone =>` setting is used to indicate timezone of the original timestamp, which is only necessary if the timestamp format does not specify a timezone, like `2017-12-04 08:00:00` (`YYYY-MM-dd HH:mm:ss`). In this example, setting timezone to `Europe/Berlin`, makes logstash convert `2017-12-04 08:00:00` to `2017-12-04T07:00:00.000Z`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 31, 2017, 5:51pm UTC](https://discuss.elastic.co/t/date-filter-and-time-zone-transition/91672/3 "2017-07-31T17:51:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.