How to change @timestamp field from UTC to local times

Elastic Stack Logstash
#1

Hi, @magnusbaeck.
I having problems with output beats, because output beats doesn't match with my local times.

Example output from metricbeat

2017-07-17T03:52:38.878Z

And my local times.

2017-07-17, 10.52

Can I use logstash to transform output beats ?

thanks

#2

What timezone are you in/is your system set to?

Please don't ping people like that. While I am sure Magnus is happy to help, he volunteers his time and is not here to be summoned.

#3

Sorry, I don't know and thanks for fast reply @warkolm.

i live in asia/bangkok UTC +07:00

image.png1203×933 32.5 KB

thanks

#4

In that case the timestamps you are seeing are correct.

That's UTC+7 as it suggests.

#5

Can I convert @timestamp match with timestamp ?

image.png1485×152 13.2 KB

thanks.

#6

No as the Elastic Stack (beats, logstash, elasticsearch) all use UTC.

Kibana then translates that to the browser timezone when you look at the data.

#8

I know beats, logstash, elasticsearch all use UTC, but what i want to know is @timestamp field can change to show my local times ?

thanks.

#9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

#10

Convert from local time to UTC at ingest time. I wrote a blog about doing this with an ingest pipeline here: https://alexmarquardt.com/2019/10/16/converting-local-time-to-iso-8601-time-in-elasticsearch/