Logstash 2.2.2 date filter returning wrong day

Elastic Stack Logstash
1

This works fine with logstash 1.5.6 but with logstash 2.2.2 it sets @timestamp to the previous day??

echo "Mon Feb 22 22:20:41.144" | /opt/logstash/bin/logstash -e '

input { stdin {codec => line} }
filter { date { match => [ "message" , "EEE MMM dd HH:mm:ss.SSS" ] } }
output { stdout {codec => rubydebug} }
'
Settings: Default pipeline workers: 2
Logstash startup completed
{
"message" => "Mon Feb 22 22:20:41.144",
"@version" => "1",
"@timestamp" => "2016-02-21T22:20:41.144Z",
"host" => "0.0.0.0"
}
Logstash shutdown completed

Any ideas?

2

That's odd. I can't reproduce. Which timezone are you in?

3

Arg :frowning:

I am testing on a canonical Ubuntu EC2 instance with just java and logstash installed:

$ java -version
java version "1.8.0_72"
Java(TM) SE Runtime Environment (build 1.8.0_72-b15)
Java HotSpot(TM) 64-Bit Server VM (build 25.72-b15, mixed mode)

$ /opt/logstash/bin/logstash -V
logstash 2.2.2
$ uname -a
Linux ip-10-0-4-211 3.13.0-74-generic #118-Ubuntu SMP Thu Dec 17 22:52:10 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
$ date +'%:z %Z'
+00:00 UTC

4

Also if I insert the year in front it works fine:
echo "2016 Mon Feb 22 22:20:41.999" | /opt/logstash/bin/logstash -e '
input { stdin {codec => line} }
filter { date { match => [ "message" , "YYYY EEE MMM dd HH:mm:ss.SSS" ] } }
output { stdout {codec => rubydebug} }
'
Settings: Default pipeline workers: 2
Logstash startup completed
{
"message" => "2016 Mon Feb 22 22:20:41.999",
"@version" => "1",
"@timestamp" => "2016-02-22T22:20:41.999Z",
"host" => "0.0.0.0"
}
Logstash shutdown completed