Get timezone for the log event arriving in logstash

(Dar Varley) #1

I'm using the date filter to create the @timestamp field based on a log_timestamp field
"log_timestamp", "%{year}-%{month}-%{day} %{time},%{ms}"

date {
    match => [ "log_timestamp", "YYYY-MM-dd HH:mm:ss,SSS" ]
    timezone => "<Log events timezone here>"

How can I get the log event's timezone in order to pass this to the date filter?

(Magnus B├Ąck) #2

This is best set at the source. Unfortunately I recall that the timezone parameter doesn't support %{varname} expansions, i.e. you can't store the timezone in a timezone field and say timezone => "%{timezone}. This has maybe changed in Logstash 1.5.

(system) #3