# Logstash creates index which is 2 dates ahead

**URL:** https://discuss.elastic.co/t/logstash-creates-index-which-is-2-dates-ahead/88004
**Category:** Logstash
**Created:** [June 2, 2017, 12:53am UTC](https://discuss.elastic.co/t/logstash-creates-index-which-is-2-dates-ahead/88004 "2017-06-02T00:53:56Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![Steve\_1](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@Steve\_1](https://discuss.elastic.co/u/Steve_1)
#### Post date: [June 2, 2017, 12:53am UTC](https://discuss.elastic.co/t/logstash-creates-index-which-is-2-dates-ahead/88004/1 "2017-06-02T00:53:56Z")

</div>

In my case log record timestamp doesn't have date value, just time, assuming that date value is current date.

logstash .conf:

```
input {
  beats {
    port => 5044
  }
}

filter {
  if [type] == "filebeat" {
    grok {
      match => {"message" => "(?<logTime>[0-9]{2}:[0-9]{2}:[0-9]{2},[0-9]{3}) (?<logLevel>[a-zA-Z]{1,})"}
    }
    mutate {
      add_field => {"logTimestamp" => "%{+YYYY-MM-dd} %{logTime}"}
      gsub => ["message", "%{logTime} ", ""]
    }
    date {
      match => ["logTimestamp", "YYYY-MM-dd HH:mm:ss,SSS"]
      remove_field => ["logTime", "logTimestamp"]
    }
  }
}

output {
  elasticsearch {
    hosts => "elasticsearch:9200"
  }
}

```

But when executing `curl 'localhost:9200/_cat/indices?v'`, I can see index `logstash-2017.06.03`, even though today is `2017.06.01`

Output log timestamp looks like: `2017-06-03T01:00:12.126Z`

What's is the issue?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [June 2, 2017, 5:40am UTC](https://discuss.elastic.co/t/logstash-creates-index-which-is-2-dates-ahead/88004/2 "2017-06-02T05:40:44Z")

</div>

Is the system time on the hosts where Logstash and Beats run set correctly?

---

<div class="post-metadata">

### Author: ![Steve\_1](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@Steve\_1](https://discuss.elastic.co/u/Steve_1)
#### Post date: [June 2, 2017, 3:48pm UTC](https://discuss.elastic.co/t/logstash-creates-index-which-is-2-dates-ahead/88004/3 "2017-06-02T15:48:59Z")

</div>

The dates are correct on those machines.  
Btw, since today Logstash index is correct.

---

<div class="post-metadata">

### Author: ![Steve\_1](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@Steve\_1](https://discuss.elastic.co/u/Steve_1)
#### Post date: [June 2, 2017, 10:58pm UTC](https://discuss.elastic.co/t/logstash-creates-index-which-is-2-dates-ahead/88004/4 "2017-06-02T22:58:12Z")

</div>

I just noticed another logstash index `logstash-217.06.03` appeared again, though the timestamp for log record is created correctly and shows todays date `2017.06.02`

I updated output in logstash.conf but that didn't fix the problem:

```
output {
  elasticsearch {
    hosts => "elasticsearch:9200"
    index => "logstash-%{+YYYY.MM.dd}"
  }
}

```

I just noticed Docker container time is 5 hours ahead from server time but the date is still 2017.06.02.  
How can I sync container time with server time?

Another observation is that all logs with timestamp after 17:00:00 indexed with timestamp of the next day - `logstash-2017.06.03`

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [June 3, 2017, 6:30am UTC](https://discuss.elastic.co/t/logstash-creates-index-which-is-2-dates-ahead/88004/5 "2017-06-03T06:30:40Z")

</div>

The time stamp is in UTC time zone, so depending on in which time zone you are located that may be correct.

---

<div class="post-metadata">

### Author: ![Steve\_1](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@Steve\_1](https://discuss.elastic.co/u/Steve_1)
#### Post date: [June 3, 2017, 9:20pm UTC](https://discuss.elastic.co/t/logstash-creates-index-which-is-2-dates-ahead/88004/6 "2017-06-03T21:20:28Z")

</div>

> [@Steve\_1](#):
>
> logTimestamp

But value of variable `logTimestamp` shows the correct date. But index time zone is different, how can I adjust it to my current time zone?

---

<div class="post-metadata">

### Author: ![Steve\_1](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@Steve\_1](https://discuss.elastic.co/u/Steve_1)
#### Post date: [June 5, 2017, 12:37am UTC](https://discuss.elastic.co/t/logstash-creates-index-which-is-2-dates-ahead/88004/7 "2017-06-05T00:37:36Z")

</div>

I just figured out Logstash created date for my log record in UTC timezone:

![](https://us1.discourse-cdn.com/elastic/original/3X/e/1/e1b8586d0b4db2bdbf3513cada5eaff2b0850004.png)

Today is still `2017-06-04` but Logstash created date value for `2017-06-05` - for UTC timezone I guess.  
Moreover, the \_index has date `2017.06.06` even 2 day ahead.

I checked Logstash container time and shows correct date of the current time zone, though ES container shows date in UTC time zone.

Is there any way to fix the value of variable `logTimestamp`?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 3, 2017, 12:38am UTC](https://discuss.elastic.co/t/logstash-creates-index-which-is-2-dates-ahead/88004/8 "2017-07-03T00:38:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.