I got an event timestamp field without timezone stored in Elasticsearch as follows;
"open-date": "2016-05-28T00:00:00"
This time is in Australia/Melbourne timezone (AEDT/AEST).
I used the following filter to covert this to timestamp with timezone and specified the timezone;
date {
match => ["open-date", "yyyy-MM-dd'T'HH:mm:ss"]
timezone => "Australia/Melbourne"
target => "open_date_timezone"
}
In rebuy rebug output I can see the following;
"open_date_timezone" => 2016-05-27T14:00:00.000Z
I want it to be with timezone i.e +10 instead of 000Z. Is it possible to achieve this in Logstash?
I will be storing this in RDBMS and will be casting the string field to timestamptz format using following snippet in SQL.
CAST (? AS timestamptz)