How dockernized logstash knows system time zone?

Elastic Stack Logstash
1

Hi

I'm using docker.elastic.co/logstash/logstash-oss:7.0.1.
Docker host(my pc) and logstash container are running in different timezone.

  • Timezone of docker host is JST
$ date
Tue May 14 14:12:22 JST 2019
  • Timezone of logstash container is UTC
bash-4.2$ date
Tue May 14 05:13:50 UTC 2019

I let logstash reads a file on docker host has JST epochtime,
and transforms JST epochtime to @timestamp by using date filter plugin.

filter {
    date {
        match => [ "beginning_time", "UNIX" ] # beginning_time: 1557808919 is JST epochtime
    }
}

As a result, @timestamp is converted JST to UTC automatically.
(This feature is very useful in different timezone)

{
          "@timestamp" => 2019-05-14T04:41:59.000Z, # Converted JST to UTC
      "beginning_time" => "1557808919",
    "executed_command" => "pwd",
                "tags" => [
        [0] "zsh_history"
    ]
}

I learned from logstash timezone is determined by system default timezone above post.

In my case, logstash in docker is running in UTC.
Therefore I think timezone of logstash in docker is too UTC.
But logtash behaves as timezone is JST.
How logstash knows docker host is running in JST?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.