How to change @timestamp field from UTC to local times

Thanadol_Thadasade · July 17, 2017, 3:55am

Hi, @magnusbaeck.
I having problems with output beats, because output beats doesn't match with my local times.

Example output from metricbeat

2017-07-17T03:52:38.878Z

And my local times.

2017-07-17, 10.52

Can I use logstash to transform output beats ?

thanks

warkolm · July 17, 2017, 4:05am

What timezone are you in/is your system set to?

Please don't ping people like that. While I am sure Magnus is happy to help, he volunteers his time and is not here to be summoned.

Thanadol_Thadasade · July 17, 2017, 4:07am

Sorry, I don't know and thanks for fast reply @warkolm.

i live in asia/bangkok UTC +07:00

thanks

warkolm · July 17, 2017, 4:08am

In that case the timestamps you are seeing are correct.

That's UTC+7 as it suggests.

Thanadol_Thadasade · July 17, 2017, 4:10am

Can I convert @timestamp match with timestamp ?

thanks.

warkolm · July 17, 2017, 4:15am

No as the Elastic Stack (beats, logstash, elasticsearch) all use UTC.

Kibana then translates that to the browser timezone when you look at the data.

Thanadol_Thadasade · July 17, 2017, 4:35am

I know beats, logstash, elasticsearch all use UTC, but what i want to know is @timestamp field can change to show my local times ?

thanks.

system · August 14, 2017, 4:36am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Alex_Marquardt · October 18, 2019, 12:01pm

Convert from local time to UTC at ingest time. I wrote a blog about doing this with an ingest pipeline here: Converting local time to ISO 8601 time in Elasticsearch