# Date issue

**URL:** https://discuss.elastic.co/t/date-issue/271322
**Category:** Logstash
**Created:** [April 27, 2021, 6:52am UTC](https://discuss.elastic.co/t/date-issue/271322 "2021-04-27T06:52:59Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![sasvmware](https://avatars.discourse-cdn.com/v4/letter/s/e0b2c6/32.png) [@sasvmware](https://discuss.elastic.co/u/sasvmware)
#### Post date: [April 27, 2021, 6:52am UTC](https://discuss.elastic.co/t/date-issue/271322/1 "2021-04-27T06:52:59Z")

</div>

Log file date is on 26th but in elasticsearch date show as 25th why ?

Logstash conf file.

input {  
beats {  
port =\> 5044  
}  
}  
filter {  
grok {  
match =\> {  
"message" =\> "%{TIMESTAMP\_ISO8601:timestamp}%{GREEDYDATA:lt\_message}"}  
}  
kv {  
source =\> "lt\_message"  
include\_keys =\> ["Transaction", "Duration", "Txn\_Status", "Project\_Name", "KBytes\_sec", "Parameters"]  
trim\_value =\> " {}\r\n"  
}  
date {  
match =\> ["timestamp", "yyyy-MM-dd HH:mm:ss.SSS"]  
target =\> "@timestamp"  
}  
mutate {  
convert =\> {"Duration" =\> "float"}  
remove\_field =\> ["@version", "timestamp","source","beat","input","host","tags","prospector","offset","message", "lt\_message", "log", "agent", "fields", "ecs", "rest"]  
remove\_tag =\> ["tags"]  
}  
}  
output {  
file {  
path =\> "/elastic/log/logstash-lt.log"  
}  
elasticsearch {  
hosts =\> ["[http://lthppc-wdc-lg13:9200/](http://lthppc-wdc-lg13:9200/)"]  
index =\> "loadtest"  
}  
}

# Log file

2021-04-26 05:01:40.613 Transaction = "SYM\_PublicEval\_LT\_S01\_T01\_Product1" Duration = 0.881012 Txn\_Status=PASS Project\_Name=LT\_VPP\_Comm\_WCM\_EPP KBytes\_sec=1258 Parameters=

2021-04-26 05:01:40.627 Transaction = "SYM\_PublicEval\_LT\_S01\_T01\_Product1" Duration = 0.881065 Txn\_Status=PASS Project\_Name=LT\_VPP\_Comm\_WCM\_EPP KBytes\_sec=1258 Parameters=

2021-04-26 05:01:40.608 Transaction = "SYM\_PublicEval\_LT\_S01\_T01\_Product1" Duration = 0.915010 Txn\_Status=PASS Project\_Name=LT\_VPP\_Comm\_WCM\_EPP KBytes\_sec=1212 Parameters=

2021-04-26 05:01:40.631 Transaction = "SYM\_PublicEval\_LT\_S01\_T01\_Product1" Duration = 0.951052 Txn\_Status=PASS Project\_Name=LT\_VPP\_Comm\_WCM\_EPP KBytes\_sec=1166 Parameters=

2021-04-26 05:01:40.657 Transaction = "SYM\_PublicEval\_LT\_S01\_T01\_Product1" Duration = 0.946489 Txn\_Status=PASS Project\_Name=LT\_VPP\_Comm\_WCM\_EPP KBytes\_sec=1171 Parameters=

2021-04-26 05:01:40.769 Transaction = "SYM\_PublicEval\_LT\_S01\_T01\_Product1" Duration = 0.897121 Txn\_Status=PASS Project\_Name=LT\_VPP\_Comm\_WCM\_EPP KBytes\_sec=1236 Parameters=

2021-04-26 05:01:40.881 Transaction = "SYM\_PublicEval\_LT\_S01\_T01\_Product1" Duration = 0.828352 Txn\_Status=PASS Project\_Name=LT\_VPP\_Comm\_WCM\_EPP KBytes\_sec=1338 Parameters=

2021-04-26 05:01:40.849 Transaction = "SYM\_PublicEval\_LT\_S01\_T01\_Product1" Duration = 0.887204 Txn\_Status=PASS Project\_Name=LT\_VPP\_Comm\_WCM\_EPP KBytes\_sec=1249 Parameters=

2021-04-26 05:01:40.734 Transaction = "SYM\_PublicEval\_LT\_S01\_T01\_Product1" Duration = 1.011191 Txn\_Status=PASS Project\_Name=LT\_VPP\_Comm\_WCM\_EPP KBytes\_sec=1096 Parameters=

2021-04-26 05:01:40.832 Transaction = "SYM\_PublicEval\_LT\_S01\_T01\_Product1" Duration = 0.932400 Txn\_Status=PASS Project\_Name=LT\_VPP\_Comm\_WCM\_EPP KBytes\_sec=1189 Parameters=

2021-04-26 05:01:40.848 Transaction = "SYM\_PublicEval\_LT\_S01\_T01\_Product1" Duration = 0.928241 Txn\_Status=PASS Project\_Name=LT\_VPP\_Comm\_WCM\_EPP KBytes\_sec=1194 Parameters=

2021-04-26 05:01:40.879 Transaction = "SYM\_PublicEval\_LT\_S01\_T01\_Product1" Duration = 0.903992 Txn\_Status=PASS Project\_Name=LT\_VPP\_Comm\_WCM\_EPP KBytes\_sec=1226 Parameters=

---

<div class="post-metadata">

### Author: ![sasvmware](https://avatars.discourse-cdn.com/v4/letter/s/e0b2c6/32.png) [@sasvmware](https://discuss.elastic.co/u/sasvmware)
#### Post date: [April 27, 2021, 6:53am UTC](https://discuss.elastic.co/t/date-issue/271322/2 "2021-04-27T06:53:58Z")

</div>

![discover](https://us1.discourse-cdn.com/elastic/original/3X/f/6/f67255dffb8d172a0924d49aa5a366058c4f9a64.jpeg)

Sharing screen shot.

---

<div class="post-metadata">

### Author: ![sasvmware](https://avatars.discourse-cdn.com/v4/letter/s/e0b2c6/32.png) [@sasvmware](https://discuss.elastic.co/u/sasvmware)
#### Post date: [April 27, 2021, 7:06am UTC](https://discuss.elastic.co/t/date-issue/271322/3 "2021-04-27T07:06:47Z")

</div>

![discover1](https://us1.discourse-cdn.com/elastic/original/3X/c/6/c6af60c3cf130e2d145e83e3edb5008cca257b2a.jpeg)

---

<div class="post-metadata">

### Author: ![sasvmware](https://avatars.discourse-cdn.com/v4/letter/s/e0b2c6/32.png) [@sasvmware](https://discuss.elastic.co/u/sasvmware)
#### Post date: [April 27, 2021, 7:08am UTC](https://discuss.elastic.co/t/date-issue/271322/4 "2021-04-27T07:08:58Z")

</div>

logfile & kibana time stamp are in PST .

---

<div class="post-metadata">

### Author: ![sasvmware](https://avatars.discourse-cdn.com/v4/letter/s/e0b2c6/32.png) [@sasvmware](https://discuss.elastic.co/u/sasvmware)
#### Post date: [April 27, 2021, 7:25am UTC](https://discuss.elastic.co/t/date-issue/271322/5 "2021-04-27T07:25:10Z")

</div>

In elasticsearch i see data as 26 but in kibana showing as 25th  
{  
"\_index" : "loadtest",  
"\_type" : "\_doc",  
"\_id" : "SXvvDXkB71udp0fEj7a2",  
"\_score" : null,  
"\_source" : {  
"Txn\_Status" : "PASS",  
"Transaction" : "SYM\_PublicEval\_LT\_S01\_T01\_Product1",  
"@timestamp" : "2021-04-26T04:27:44.170Z",  
"Parameters" : """  
""",  
"KBytes\_sec" : "488",  
"Duration" : 2.272314,  
"Project\_Name" : "LT\_VPP\_Comm\_WCM\_EPP"  
},  
"sort" : [  
1619411264170  
]  
},  
{  
"\_index" : "loadtest",  
"\_type" : "\_doc",  
"\_id" : "S3vvDXkB71udp0fEj7a2",  
"\_score" : null,  
"\_source" : {  
"Txn\_Status" : "PASS",  
"Transaction" : "SYM\_PublicEval\_LT\_S01\_T01\_Product1",  
"@timestamp" : "2021-04-26T04:27:44.208Z",  
"Parameters" : """  
""",  
"KBytes\_sec" : "493",  
"Duration" : 2.24742,  
"Project\_Name" : "LT\_VPP\_Comm\_WCM\_EPP"  
},

---

<div class="post-metadata">

### Author: ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)
#### Post date: [April 27, 2021, 7:31am UTC](https://discuss.elastic.co/t/date-issue/271322/6 "2021-04-27T07:31:20Z")

</div>

Hi @sasvmware ,

I would try

> [@sasvmware](#):
>
> date {  
> match =\> ["timestamp", "ISO8601"]  
> target =\> "@timestamp"  
> }

And don't remove `tags` before this is working. The tags can be quite useful when debugging issues.

Hope that helps 🙂

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 27, 2021, 2:11pm UTC](https://discuss.elastic.co/t/date-issue/271322/7 "2021-04-27T14:11:46Z")

</div>

> [@sasvmware](#):
>
> logfile & kibana time stamp are in PST .

In logstash and elasticsearch timestamps are always in UTC, kibana will adjust that to the local timezone of the browser. That is 8 hours behind PST, 7 behind PDT, so times early on the 26th in PST will be late on the 25th in UTC.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 25, 2021, 2:12pm UTC](https://discuss.elastic.co/t/date-issue/271322/8 "2021-05-25T14:12:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.