# Getting @timestamp value in Server's timezone, not UTC

**URL:** <https://discuss.elastic.co/t/getting-timestamp-value-in-servers-timezone-not-utc/99295>\
**Category:** Logstash\
**Created:** [September 4, 2017, 1:00pm UTC](https://discuss.elastic.co/t/getting-timestamp-value-in-servers-timezone-not-utc/99295 "2017-09-04T13:00:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![anisen](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@anisen](https://discuss.elastic.co/u/anisen)\
**Post date:** [September 4, 2017, 1:00pm UTC](https://discuss.elastic.co/t/getting-timestamp-value-in-servers-timezone-not-utc/99295/1 "2017-09-04T13:00:31Z")

</div>

Hi,

My log-line looks like:  
12.170.89.115 [22/Aug/2017:00:08:11 **-0400**] "GET /home.html HTTP/1.1" 200 714 13818 - (-) "-" "Java/1.5.0"

And the grok filter is:  
grok {  
match =\> {  
"message" =\> '%{IPORHOST:clientip} [%{MONTHDAY:day}/%{MONTH:month}/%{YEAR:year}:%{TIME:time} %{INT:timezone}] "%{NOTSPACE:method} %{NOTSPACE:uri} HTTP/%{NOTSPACE:httpversion}" %{NOTSPACE:status} %{NOTSPACE:size} %{NUMBER:responsetime:int} %{NOTSPACE:hostname} %{NOTSPACE:ratio} %{QS:referrer} %{QS:agent}'  
}  
}

mutate {  
add\_field =\> {  
"timestamp" =\> "%{mday}/%{month}/%{year}:%{time}"  
}  
}  
date {  
match =\> ["timestamp", "dd/MMM/YYYY:HH:mm:ss"]  
timezone =\> "America/Aruba"  
}

Result: @timestamp": "2017-08-22T04:08:11.000Z

**But,**  
**GOAL is to get the @timestamp value in the server timezone;i.e, "@timestamp": "2017-08-21T20:08:11.000Z"**

To achieve this I have changed the timezone to "Asia/Dubai" which is actually +0400 and not -0400.  
date {  
match =\> ["timestamp", "dd/MMM/YYYY:HH:mm:ss"]  
timezone =\> "Asia/Dubai"  
}

Is this a correct way to do?? Is there any better alternative for this?  
Please suggest.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 4, 2017, 1:12pm UTC](https://discuss.elastic.co/t/getting-timestamp-value-in-servers-timezone-not-utc/99295/2 "2017-09-04T13:12:07Z")

</div>

Elasticsearch and the rest of the stack requires timestamp fields to be in UTC, so trying to force it into something else will cause problems.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 2, 2017, 1:12pm UTC](https://discuss.elastic.co/t/getting-timestamp-value-in-servers-timezone-not-utc/99295/3 "2017-10-02T13:12:14Z")

</div>

Closed on October 2, 2017, 1:12pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.