Logstash Date and Kibana Issues

Not really sure where this goes but it isn't getting any bites in the Logstash forums so...

I have a field that tracks when a ticket was created, sys_created_on. The time is in local timezone, -05:00 currently. I have the following logstash config:

  date {
    match => [ "sys_created_on", "yyyy-MM-dd HH:mm:ss" ]
    timezone => "America/Chicago"

In Kibana, I am using the @timestamp field as the time field. When events come up in Kibana, they show a time that is five hours in the future. When I look at the JSON data, it is showing a timestamp 10 hours in the future. What the hell am I doing wrong??


I do think this belongs in the Logstash forum so I'll move it back over, but I did find this similar issue which may help!


Is sys_created_on a string? Also, what does your input look like? I am wondering if you are fetching from a DB and the input is doing the conversion to the local timezone or something like that.

http_poller pulls from an API endpoint that delivers the data in a json formatted document. The value is a string in the json and is local time.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.