# How to change timestamp adding by logstash while sending logs to output plugin

**URL:** https://discuss.elastic.co/t/how-to-change-timestamp-adding-by-logstash-while-sending-logs-to-output-plugin/244799
**Category:** Logstash
**Created:** [August 13, 2020, 5:51am UTC](https://discuss.elastic.co/t/how-to-change-timestamp-adding-by-logstash-while-sending-logs-to-output-plugin/244799 "2020-08-13T05:51:52Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![aksshm](https://avatars.discourse-cdn.com/v4/letter/a/50afbb/32.png) [@aksshm](https://discuss.elastic.co/u/aksshm)
#### Post date: [August 13, 2020, 5:51am UTC](https://discuss.elastic.co/t/how-to-change-timestamp-adding-by-logstash-while-sending-logs-to-output-plugin/244799/1 "2020-08-13T05:51:52Z")

</div>

Hi, I'm running logstash with kafka as input plugin and syslog as output plugin.  
For kafka , all the messages are with local timezone/required timezone but while sending to syslog logstash is adding a timestamp in front of each message(i.e in UTC). How can i change those timestamp?

ex:

```auto
Aug 13 05:43:41 REDIS-LOG {"kubernetes":{"pod":{"uid":"ac360b5a-2dc5-459f-8c3b-e0eb236d31fc","name":"redis-master-67c9ffcd9f-tvmvb"}},"ecs":{"version":"1.1.0"},"agent":{"hostname":"filebeat-z7z6r","version":"7.5.1","ephemeral_id":"8f1310ba-4512-40f3-9406-0672fb8bd63f","type":"filebeat","id":"21f6b5b4-71d5-4a19-8341-996a66cef946"}

```

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 13, 2020, 2:54pm UTC](https://discuss.elastic.co/t/how-to-change-timestamp-adding-by-logstash-while-sending-logs-to-output-plugin/244799/2 "2020-08-13T14:54:09Z")

</div>

The syslog output [unconditionally](https://github.com/logstash-plugins/logstash-output-syslog/blob/9a6130586b130da01db54368a523840b6bb904df/lib/logstash/outputs/syslog.rb#L168) (in both the if and the else branches) adds a timestamp based on @timestamp, which is normally UTC. If you want the syslog timestamp to be in a different timezone you will have to change the timezone of @timestamp.

---

<div class="post-metadata">

### Author: ![aksshm](https://avatars.discourse-cdn.com/v4/letter/a/50afbb/32.png) [@aksshm](https://discuss.elastic.co/u/aksshm)
#### Post date: [August 13, 2020, 2:58pm UTC](https://discuss.elastic.co/t/how-to-change-timestamp-adding-by-logstash-while-sending-logs-to-output-plugin/244799/3 "2020-08-13T14:58:12Z")

</div>

Thanks, is there any way to change timestamp in config yaml or i need to change the base code?  
if config yaml has parameter to change please let us know, it would great help!!1

thanks again.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 13, 2020, 2:59pm UTC](https://discuss.elastic.co/t/how-to-change-timestamp-adding-by-logstash-while-sending-logs-to-output-plugin/244799/4 "2020-08-13T14:59:37Z")

</div>

You will need to change the filter configuration. You cannot do it in the yml.

---

<div class="post-metadata">

### Author: ![aksshm](https://avatars.discourse-cdn.com/v4/letter/a/50afbb/32.png) [@aksshm](https://discuss.elastic.co/u/aksshm)
#### Post date: [August 13, 2020, 3:01pm UTC](https://discuss.elastic.co/t/how-to-change-timestamp-adding-by-logstash-while-sending-logs-to-output-plugin/244799/5 "2020-08-13T15:01:35Z")

</div>

filter configuration you mean filter plugin? if yes, then we can add filter plugin in yaml right?  
or can we remove this parameter completely, anyways we have timestamp in the messages so we don't need this @timestamp parameter..

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 13, 2020, 3:04pm UTC](https://discuss.elastic.co/t/how-to-change-timestamp-adding-by-logstash-while-sending-logs-to-output-plugin/244799/6 "2020-08-13T15:04:16Z")

</div>

@timestamp is required.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 10, 2020, 3:04pm UTC](https://discuss.elastic.co/t/how-to-change-timestamp-adding-by-logstash-while-sending-logs-to-output-plugin/244799/7 "2020-09-10T15:04:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
