# How to retain the time zone and nanoseconds in timestamp when migrating es through logstash

**URL:** <https://discuss.elastic.co/t/how-to-retain-the-time-zone-and-nanoseconds-in-timestamp-when-migrating-es-through-logstash/368002>\
**Category:** Logstash\
**Created:** [September 30, 2024, 9:27am UTC](https://discuss.elastic.co/t/how-to-retain-the-time-zone-and-nanoseconds-in-timestamp-when-migrating-es-through-logstash/368002 "2024-09-30T09:27:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![baobaoda](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@baobaoda](https://discuss.elastic.co/u/baobaoda)\
**Post date:** [September 30, 2024, 9:27am UTC](https://discuss.elastic.co/t/how-to-retain-the-time-zone-and-nanoseconds-in-timestamp-when-migrating-es-through-logstash/368002/1 "2024-09-30T09:27:51Z")

</div>

In the old cluster, the timestamp is "@timestamp": "2024-08-12T17:40:31.098422413+08:00". For stability reasons, I still want to keep it after migrating to the new cluster. I have tried many filters like behind, but none of them work. The new cluster has always been "@timestamp": "2024-08-12T09:40:31.098Z". I don't know if it's because there is no match or some other reason.How to retain the time zone and nanoseconds format

```auto
date {
    match => ["@timestamp", "yyyy-MM-dd'T'HH:mm:ss.SSSSSSSSSZ"]
    timezone => "Asia/Shanghai"
    target => "@timestamp"
  }

```

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [September 30, 2024, 10:33am UTC](https://discuss.elastic.co/t/how-to-retain-the-time-zone-and-nanoseconds-in-timestamp-when-migrating-es-through-logstash/368002/2 "2024-09-30T10:33:32Z")

</div>

This was explained [here](https://discuss.elastic.co/t/logstash-failed-to-parse-date-6-milliseconds/299271).

Credits to Badger

Here is a sample:

```auto
input {
 generator { 
        # message => ["2024-08-12T09:40:31.098Z"]
        message => ["2024-08-12T17:40:31.098422413+08:00"]
        count => 1
 }
}
output {
 stdout {codec => rubydebug}
}
filter {

date {
    match => ["message", "yyyy-MM-dd'T'HH:mm:ss.SSSSSSSSSZ"] # "ISO8601"
    timezone => "Asia/Shanghai"
    target => "@timestamp"
  }
  ruby {
    code => "event.set('[longformat]', LogStash::Timestamp.new(event.get('[message]')) )"
  }
     mutate { remove_field => ["@version", "event", "host"] }
}

```

Output:

```auto
{
       "message" => "2024-08-12T17:40:31.098422413+08:00",
    "@timestamp" => 2024-08-12T09:40:31.098Z,
    "longformat" => 2024-08-12T09:40:31.098422413Z
}

```

---

<div class="post-metadata">

**Author:** ![baobaoda](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@baobaoda](https://discuss.elastic.co/u/baobaoda)\
**Post date:** [October 8, 2024, 3:02am UTC](https://discuss.elastic.co/t/how-to-retain-the-time-zone-and-nanoseconds-in-timestamp-when-migrating-es-through-logstash/368002/3 "2024-10-08T03:02:41Z")

</div>

Thank you for your suggestion to keep the nano format. I still want to know how to keep the time zone. I added the Shanghai time zone and it didn't work. I want to keep +8:00. The purpose is to keep the format of the full data and incremental data consistent to avoid possible problems in the future. Thank you very much for your advice.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [October 8, 2024, 9:52am UTC](https://discuss.elastic.co/t/how-to-retain-the-time-zone-and-nanoseconds-in-timestamp-when-migrating-es-through-logstash/368002/4 "2024-10-08T09:52:32Z")

</div>

If you need date and time before 08:00:

```auto
filter {

dissect { mapping => {
        "message" => "%{tmpmsg}+%{}"
      }
}
 mutate {
        add_field => { "timeshanghai" => "%{[tmpmsg]}+00:00Z" }
    }

		
date {
    match => ["message", "yyyy-MM-dd'T'HH:mm:ss.SSSSSSSSSZ"] # "ISO8601"
    timezone => "Asia/Shanghai"
    target => "@timestamp1"
  }
  
  ruby {
    code => "event.set('[@timestamp]', LogStash::Timestamp.new(event.get('[timeshanghai]')) )"
  } 
     mutate { remove_field => ["@version", "event", "host", "timeshanghai", "tmpmsg"] }
	 
}

```

Output:

```auto
{
     "@timestamp" => 2024-08-12T17:40:31.098422413Z,
        "message" => "2024-08-12T17:40:31.098422413+08:00",
    "@timestamp1" => 2024-08-12T09:40:31.098Z
}

```