# Date showing as UTC and indexed like it and not in local time

**URL:** <https://discuss.elastic.co/t/date-showing-as-utc-and-indexed-like-it-and-not-in-local-time/120382>\
**Category:** Kibana\
**Created:** [February 19, 2018, 12:48am UTC](https://discuss.elastic.co/t/date-showing-as-utc-and-indexed-like-it-and-not-in-local-time/120382 "2018-02-19T00:48:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![LLK](https://avatars.discourse-cdn.com/v4/letter/l/8c91f0/32.png) [@LLK](https://discuss.elastic.co/u/LLK)\
**Post date:** [February 19, 2018, 12:48am UTC](https://discuss.elastic.co/t/date-showing-as-utc-and-indexed-like-it-and-not-in-local-time/120382/1 "2018-02-19T00:48:55Z")

</div>

Hello,

I have some auth0 logs streamed via Logstash where I use date filter to capture the date from the message itself.  
In the message the date is in the form of: 2018-02-19T00:35:32.145Z

My date filter looks like this:  
date {  
match =\> ["date", "YYYY-MM-dd'T'HH:mm:ss.SSS'Z'"]  
timezone =\> "Australia/Melbourne"  
}

In Kibana: Advanced settings set to: dateFormat:tz - Browser (I was playing and changing it to Australia/Melbourne but no luck)

Indexed dates are:  
date coming from the message: 2018-02-19T00:35:32.145Z  
date created by the "date" plugin: 2018-02-18T13:35:32.145Z

current AEDT date: February 19th 2018, 11:35:32

In Kibana I search for events and search is going by the current Australian time (That's also what I want it to be). But events appearing in the past due to the UTC time in the index.

How can I fix it - The search for events and the @timestamp presentation in local time?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 19, 2018, 5:26am UTC](https://discuss.elastic.co/t/date-showing-as-utc-and-indexed-like-it-and-not-in-local-time/120382/2 "2018-02-19T05:26:51Z")

</div>

`2018-02-19T00:35:32.145Z` is the same as `2018-02-18T13:35:32.145Z`. The former is just +11 which is what TZ `Australia/Melbourne` is.

---

<div class="post-metadata">

**Author:** ![LLK](https://avatars.discourse-cdn.com/v4/letter/l/8c91f0/32.png) [@LLK](https://discuss.elastic.co/u/LLK)\
**Post date:** [February 20, 2018, 12:57am UTC](https://discuss.elastic.co/t/date-showing-as-utc-and-indexed-like-it-and-not-in-local-time/120382/3 "2018-02-20T00:57:58Z")

</div>

Yeah but in Kibana it doesn't reflect the time in local time +11 hours as you've said.  
So events appear to be in the past.  
Any idea on how to fix it?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 20, 2018, 1:07am UTC](https://discuss.elastic.co/t/date-showing-as-utc-and-indexed-like-it-and-not-in-local-time/120382/4 "2018-02-20T01:07:36Z")

</div>

Kibana will use local system time from the browser and then convert things accordingly.  
It'd be worth checking that.

---

<div class="post-metadata">

**Author:** ![LLK](https://avatars.discourse-cdn.com/v4/letter/l/8c91f0/32.png) [@LLK](https://discuss.elastic.co/u/LLK)\
**Post date:** [February 20, 2018, 2:28am UTC](https://discuss.elastic.co/t/date-showing-as-utc-and-indexed-like-it-and-not-in-local-time/120382/5 "2018-02-20T02:28:27Z")

</div>

Yeah, as I've mentioned in my original post I've tried to:  
In Kibana: Advanced settings set to: dateFormat:tz - Browser (I was playing and changing it to Australia/Melbourne but no luck)

But nevertheless events appear in the past. so I have to use "target" to move message timestamp field to "message\_time":  
date {  
match =\> ["date", "YYYY-MM-dd'T'HH:mm:ss.SSS'Z'"]  
timezone =\> "Australia/Melbourne"  
target =\> "message\_date"  
}

See for yourself:

message {"date":"2018-02-20T01:35:46.415Z","type":"sepft","description":"","connection":"MyAccountUsers","connection\_id":"con\_lTBdDeovGBu44Bk1","client\_id":"qRQRF4upIkHN5tJK72nukXJQKGidvmgk","client\_name":"LegacyMobileApp","ip":"13.55.240.10","user\_agent":"Apache-HttpClient 4.5.2 / Other 0.0.0","user\_id":"auth0|MyAccountUser|U00000092030","user\_name":"bro59@gmail.com","audience":"[https://digitalapi](https://digitalapi)","scope":"openid email","\_id":"90020180220013546415749875000555906985398907141626003458","log\_id":"90020180220013546415749875000555906985398907141626003458","isMobile":false}

message\_date February 20th 2018, 01:35:46.415  
post\_date 1,519,090,828,356  
@timestamp February 20th 2018, 12:40:28.579 \<- THIS IS INGESTION TIME (I WOULD LIKE THIS TO BE message\_date but not in the past)

Here is what Logstash is passing to ElasticSearch:  
"message\_date" =\> 2018-02-19T14:35:46.415Z,  
"post\_date" =\> 1519090828356,  
"@timestamp" =\> 2018-02-20T01:40:28.579Z,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2018, 2:28am UTC](https://discuss.elastic.co/t/date-showing-as-utc-and-indexed-like-it-and-not-in-local-time/120382/6 "2018-03-20T02:28:34Z")

</div>

Closed on March 20, 2018, 2:28am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.