Date filter - timestamp & @timestamp are diffrent

[ssasporta (Sharon Sasporta)]

Hi,

The timestamp in the log is : 26/Jul/2017:00:00:00

I defined a pattern: HTTPDATE %{MONTHDAY}/%{MONTH}/%{YEAR}:%{TIME}

In the grok I have it : %{HTTPDATE:timestamp}

And this is the filter I do:

        date {
              match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss" ]
        }

The results in output:

  "timestamp" => "26/Jul/2017:00:00:00",

  "@timestamp" => 2017-07-25T21:00:00.000Z,

Why isn't it the same? Any idea?

Thanks
Sharon.

[magnusbaeck (Magnus Bäck)]

timestamp is local time and @timestamp is UTC.