I want to save index by my own time zone

Elastic Stack Logstash
1 
output {
		elasticsearch { 
						hosts => localhost	  	
						index => "logstash(%{+yyyy.MM.dd})"  
						document_type =>"logstash"
		}   
		stdout {  
            codec => rubydebug
        }
}

index => "logstash(%{+yyyy.MM.dd})" now it use @timestamp and it is utc time
i don't want to change @timestamp ,i want to save index by my own time zone

2

The %{+yyyy.MM.dd} notation always uses UTC. You can use a ruby filter to store whatever date format you want in a @metadata field and reference that instead. This has been discussed many times before so please search the archives.

1 Like
3

thank you thank you~

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.