# I wonder about logstash YYYY.MM.dd **URL:** \ **Category:** Logstash\ **Created:** [July 14, 2020, 7:24am UTC](https://discuss.elastic.co/t/i-wonder-about-logstash-yyyy-mm-dd/241073 "2020-07-14T07:24:00Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![111349](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111349/32/69694_2.png) [@111349](https://discuss.elastic.co/u/111349)\ **Post date:** [July 14, 2020, 7:24am UTC](https://discuss.elastic.co/t/i-wonder-about-logstash-yyyy-mm-dd/241073/1 "2020-07-14T07:24:00Z")
I am not sure what logstash YYYY.MM.dd is based on. I'm in asia/seoul area and I also sent a message at 1am. The 13th was 1:00 a.m. on the 14th, but there was no newly created 14-day index in elasticsearch. I searched for other similar questions and saw that @timestamp is the standard. Obviously, the timestamp was 14 days, but there was no new 14-day index. If I am doing something wrong, can I make YYYY.MM.dd into the future if I change @timestamp into the future using logstash's date filter? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 14, 2020, 7:35am UTC](https://discuss.elastic.co/t/i-wonder-about-logstash-yyyy-mm-dd/241073/2 "2020-07-14T07:35:12Z")
It's UTC, always UTC. If you don't have a `date` filter in your Logstash config to make sure `@timestamp` is correctly calculated, that may be what you are seeing. ---
**Author:** ![111349](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111349/32/69694_2.png) [@111349](https://discuss.elastic.co/u/111349)\ **Post date:** [July 14, 2020, 10:22am UTC](https://discuss.elastic.co/t/i-wonder-about-logstash-yyyy-mm-dd/241073/3 "2020-07-14T10:22:57Z")
Does that mean that the value of timestamp has no effect on YYYY.MM.dd? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 14, 2020, 10:31am UTC](https://discuss.elastic.co/t/i-wonder-about-logstash-yyyy-mm-dd/241073/4 "2020-07-14T10:31:23Z")
It does, but again it all defaults to UTC. ---
**Author:** ![111349](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111349/32/69694_2.png) [@111349](https://discuss.elastic.co/u/111349)\ **Post date:** [July 15, 2020, 2:24am UTC](https://discuss.elastic.co/t/i-wonder-about-logstash-yyyy-mm-dd/241073/5 "2020-07-15T02:24:55Z")
Thank you for answer. If so, can logstash change the affected UCT to the @timestamp value I changed? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 15, 2020, 2:30am UTC](https://discuss.elastic.co/t/i-wonder-about-logstash-yyyy-mm-dd/241073/6 "2020-07-15T02:30:24Z")
Logstash will always treat that as if it's UTC. ---
**Author:** ![111349](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111349/32/69694_2.png) [@111349](https://discuss.elastic.co/u/111349)\ **Post date:** [July 15, 2020, 6:45am UTC](https://discuss.elastic.co/t/i-wonder-about-logstash-yyyy-mm-dd/241073/7 "2020-07-15T06:45:32Z")
Is there any way to change it to something other than UTC? ---
**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\ **Post date:** [July 15, 2020, 8:09am UTC](https://discuss.elastic.co/t/i-wonder-about-logstash-yyyy-mm-dd/241073/8 "2020-07-15T08:09:13Z")
`@timestamp` is always stored and printed as UTC. If you want to create a string with the local time, you'll have to use Ruby. ```auto filter { ruby { code => "event.set('[@metadata][localtime]', event.get('@timestamp').time.localtime.strftime('%Y.%m.%d %H:%M:%S'))" } } ``` ---
**Author:** ![111349](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111349/32/69694_2.png) [@111349](https://discuss.elastic.co/u/111349)\ **Post date:** [July 15, 2020, 8:30am UTC](https://discuss.elastic.co/t/i-wonder-about-logstash-yyyy-mm-dd/241073/9 "2020-07-15T08:30:50Z")
I use the date filter to change the value of @timestamp in the message I have.(logstash1) And after passing it to kafka as output, I index into elasticsearch using another logstash2. Then set in logstash2 index =\> %{+YYYY.MM.dd} Is it determined by the value of @timestamp I changed in logstash1? I think this is the problem i have. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 15, 2020, 9:07pm UTC](https://discuss.elastic.co/t/i-wonder-about-logstash-yyyy-mm-dd/241073/10 "2020-07-15T21:07:22Z")
You are really working against the way the system is designed. Elasticsearch uses UTC, so the indices that are created are done so using UTC, and the data is then stored as UTC (with a timezone). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 12, 2020, 9:07pm UTC](https://discuss.elastic.co/t/i-wonder-about-logstash-yyyy-mm-dd/241073/11 "2020-08-12T21:07:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.