I have some odd problem with @timestamp field in my indices which include incorrect time i.e. minus two hours. Logstash should populate time to @timestamp from logs on the base of this:
if ("" in [hi.my_date]) {
date {
match => ["hi.my_date", "YYYY-MM-dd'T'HH:mm:ss.SSS"]
timezonde => "Europe/Warsaw"
target => "@timestamp"
}
}
What is wrong in my configuration? Is there anything I don't know about the @timestamp field?
@ylasri ok, it is clear now for me. I didn't know about it.
Where is it described in the Elasticsearch documentation? Could you give me some link to the Elasticsearch documentation which describe it, please? Thanks
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.