I am shipping logs to logstash from filebeat. I have added the processor to add beat.timezone. But, when beat.timezone returns "EDT" (which currently is correct), logstash fails to parse as its unable to identify EDT. in Joda timezone, EDT is referred as EST5EDT. Is there a way to overcome this issue in logstash and parse timezones from filebeat?
You could use a translate filter in Logstash to translate EDT values to EST4EDT (or a UTC offset). Sure, you'll have to enumerate all timezone values you'll be using but presumably they're not too many of them.
Thought about it,but yeah, need to add for all the relevant timezones. Was hoping for a more straightforward solution as EDT is part of ISO.
What ISO standard describes EDT?
My bad. I meant that EDT is an accepted standard timezone specification.
From https://www.cl.cam.ac.uk/~mgk25/iso-time.html ,
"There exists no international standard that specifies abbreviations for civil time zones like CET, EST, etc. and sometimes the same abbreviation is even used for two very different time zones. In addition, politicians enjoy modifying the rules for civil time zones, especially for daylight saving times, every few years, so the only really reliable way of describing a local time zone is to specify numerically the difference of local time to UTC. Better use directly UTC as your only time zone where this is possible and then you do not have to worry about time zones and daylight saving time changes at all."
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.