# Index creates in different timezone other than UTC?
**URL:** https://discuss.elastic.co/t/index-creates-in-different-timezone-other-than-utc/148941
**Category:** Elasticsearch
**Created:** [September 18, 2018, 9:04am UTC](https://discuss.elastic.co/t/index-creates-in-different-timezone-other-than-utc/148941 "2018-09-18T09:04:20Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@af615dbd55cac2cacf32](https://discuss.elastic.co/u/af615dbd55cac2cacf32)
#### Post date: [September 18, 2018, 9:04am UTC](https://discuss.elastic.co/t/index-creates-in-different-timezone-other-than-utc/148941/1 "2018-09-18T09:04:20Z")
Hello,
My ELK servers are located in Asia/Seoul timezone which is GMT+9:00. Elasticsearch creates indices on a daily basis, but the indices are created at 9AM (instead of 12AM) due to timezone difference.
I know Kibana corrects the timezone with browser's timzone but I need to run Curator at 1AM every day to move indices from hot to warm nodes. currently Curator is unable to execute allocation at 1AM because Logstash/Elasticsearch use 'yesterday' index until 9AM.
- How can i create index with different timezone other than UTC?
- To do this, should I change @timestamp? or is there anything i should do in Elasticsearch "\_template"?
- If I change @timestamp with 'Asiz/Seoul' timezone (maybe using Ruby?), below output for elasticsearch "YYMMdd" will work properly and index will be created at 12AM (probably 12:00:01)?
Please let me know.
thank you!
My Logstash output looks like below
output {
elasticsearch {
hosts =\> ["els-01:9200","els-02:9200"]
index =\> "index\_%{+YYYYMMdd}"
}
}
Curator: action.yml
actions:
1:
action: allocation
description: "Apply shard allocation filtering rules to the specified indices"
options:
key: box\_type
value: warm
allocation\_type: require
wait\_for\_completion: true
timeout\_override:
continue\_if\_exception: false
disable\_action: false
filters:
- filtertype: pattern
kind: prefix
value: index\_
- filtertype: age
source: name
direction: older
timestring: '%Y%m%d'
unit: days
unit\_count: 1
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 18, 2018, 9:08am UTC](https://discuss.elastic.co/t/index-creates-in-different-timezone-other-than-utc/148941/2 "2018-09-18T09:08:57Z")
As mentioned in your other thread, Elasticsearch uses UTC and so does Logstash, you cannot change that sorry.
---
### Author:  [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [September 18, 2018, 12:26pm UTC](https://discuss.elastic.co/t/index-creates-in-different-timezone-other-than-utc/148941/3 "2018-09-18T12:26:19Z")
You also should not change it. Just figure out what your offset from UTC is, and work accordingly with your local cron setup that way to compensate.
---
### Author:  [@af615dbd55cac2cacf32](https://discuss.elastic.co/u/af615dbd55cac2cacf32)
#### Post date: [September 18, 2018, 11:45pm UTC](https://discuss.elastic.co/t/index-creates-in-different-timezone-other-than-utc/148941/4 "2018-09-18T23:45:26Z")
KST(UTC+9)
To do this with cronjob, i need to run cronjob (for curator) after 9AM after ‘today’ new indices are created. But there is too many traffics already. That’s why i wated to run cronjob at 1AM during not busy hours.
Thank you!
---
### Author:  [@af615dbd55cac2cacf32](https://discuss.elastic.co/u/af615dbd55cac2cacf32)
#### Post date: [September 18, 2018, 11:48pm UTC](https://discuss.elastic.co/t/index-creates-in-different-timezone-other-than-utc/148941/5 "2018-09-18T23:48:15Z")
Fyi,
I guess i didn’t mention that i would store only 1day(‘today’) indices in hot node due to storage issue.
---
### Author:  [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [September 19, 2018, 12:19am UTC](https://discuss.elastic.co/t/index-creates-in-different-timezone-other-than-utc/148941/6 "2018-09-19T00:19:11Z")
Sounds like a use case for rollover indices instead, then. Rollover the indices at midnight in your time zone, and migrate them to the warm node. There's no real need to keep one day's data in a single index, is there? The index patterns in Kibana don't see day boundaries.
---
### Author:  [@af615dbd55cac2cacf32](https://discuss.elastic.co/u/af615dbd55cac2cacf32)
#### Post date: [September 19, 2018, 4:32am UTC](https://discuss.elastic.co/t/index-creates-in-different-timezone-other-than-utc/148941/7 "2018-09-19T04:32:37Z")
I guess below options are potentials with limited disk storage (hot nodes) situation.
#1. add disk space and configure Elasticsearch config file to use new disk.
#2. indices creation period change so Logstash will call Elasticsearch to create HOURLY based indices. then, curator will run every 12hours to move previous 12hours indices from hot to warm node.
I am also considering to do above #1 option, but it can be happened sometime next month. When it is done, we can store more than 1day indices in hot node, but currently hot node disk size is not enough so as I posted here I would store only 1day 'today' indices.
If I will go for above #2 option, is there anything I need to change/configure on Elasticsearch side? I guess not but wanted to confirm.
Please advise.
Thank you!
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [September 19, 2018, 5:21am UTC](https://discuss.elastic.co/t/index-creates-in-different-timezone-other-than-utc/148941/8 "2018-09-19T05:21:08Z")
Go with the rollover index API as Aaron suggested, as this is very flexible and allows you to cut indices at any point in time. Switching to hourly indices seems like a bad idea as [having lots of small indices/shards can be very inefficien](https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster)t.
---
### Author:  [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [September 19, 2018, 11:50am UTC](https://discuss.elastic.co/t/index-creates-in-different-timezone-other-than-utc/148941/9 "2018-09-19T11:50:57Z")
@Christian_Dahlqvist beat me to it. Rollover is a much better approach.
---
### Author:  [@af615dbd55cac2cacf32](https://discuss.elastic.co/u/af615dbd55cac2cacf32)
#### Post date: [September 19, 2018, 1:46pm UTC](https://discuss.elastic.co/t/index-creates-in-different-timezone-other-than-utc/148941/10 "2018-09-19T13:46:24Z")
Thank you! I will try Rollover tomorrow 🙂
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [September 20, 2018, 12:12pm UTC](https://discuss.elastic.co/t/index-creates-in-different-timezone-other-than-utc/148941/11 "2018-09-20T12:12:43Z")
you can specify a timezone in the [elasticsearch date math](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/date-math-index-names.html#date-math-index-names)... if that helps (even though I personally prefer to stay within UTC bounds here).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 18, 2018, 12:24pm UTC](https://discuss.elastic.co/t/index-creates-in-different-timezone-other-than-utc/148941/12 "2018-10-18T12:24:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.