# Logstash date issue

**URL:** <https://discuss.elastic.co/t/logstash-date-issue/158465>\
**Category:** Logstash\
**Created:** [November 28, 2018, 5:59am UTC](https://discuss.elastic.co/t/logstash-date-issue/158465 "2018-11-28T05:59:54Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![aabababba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aabababba/32/36732_2.png) [@aabababba](https://discuss.elastic.co/u/aabababba)\
**Post date:** [November 28, 2018, 5:59am UTC](https://discuss.elastic.co/t/logstash-date-issue/158465/1 "2018-11-28T05:59:54Z")

</div>

```auto
date {
       match => ["logtime","HH:mm:ss,SSS","ISO8601"]
       target => "logtime1"
       locale => "cn"
       timezone => "Asia/Shanghai"
     }

```

now result become

logtime  
13:43:12,009

logtime1  
2018-01-01T05:43:12.009Z

anyidea?

---

<div class="post-metadata">

**Author:** ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)\
**Post date:** [December 5, 2018, 3:47am UTC](https://discuss.elastic.co/t/logstash-date-issue/158465/2 "2018-12-05T03:47:08Z")

</div>

That is correct.  
All timestamps are saved in UTC.

---

<div class="post-metadata">

**Author:** ![aabababba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aabababba/32/36732_2.png) [@aabababba](https://discuss.elastic.co/u/aabababba)\
**Post date:** [December 5, 2018, 7:57am UTC](https://discuss.elastic.co/t/logstash-date-issue/158465/3 "2018-12-05T07:57:56Z")

</div>

but date not correct, it is 2018-11-30 not 2018-01-01

---

<div class="post-metadata">

**Author:** ![yuxiao](https://avatars.discourse-cdn.com/v4/letter/y/ad7895/32.png) [@yuxiao](https://discuss.elastic.co/u/yuxiao)\
**Post date:** [December 5, 2018, 8:11am UTC](https://discuss.elastic.co/t/logstash-date-issue/158465/4 "2018-12-05T08:11:33Z")

</div>

me too，In Mysql the time type is timestamp，sync to es，the time zone is 00:00,  
example: last\_login\_time =\> 2018-03-22T21:51:51.000Z，which format i should be use?

---

<div class="post-metadata">

**Author:** ![aabababba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aabababba/32/36732_2.png) [@aabababba](https://discuss.elastic.co/u/aabababba)\
**Post date:** [December 5, 2018, 8:51am UTC](https://discuss.elastic.co/t/logstash-date-issue/158465/5 "2018-12-05T08:51:05Z")

</div>

兄弟，你咋取的时间值。。。

---

<div class="post-metadata">

**Author:** ![yuxiao](https://avatars.discourse-cdn.com/v4/letter/y/ad7895/32.png) [@yuxiao](https://discuss.elastic.co/u/yuxiao)\
**Post date:** [December 5, 2018, 8:58am UTC](https://discuss.elastic.co/t/logstash-date-issue/158465/6 "2018-12-05T08:58:20Z")

</div>

时间类型在MySQL中是timestamp，不做任何处理的话，转存到ES后，有个时区的时差，现在想通过date的filter解决，发现格式不匹配~~~ 同步到ES中的格式为 ： 2018-11-16T08:00:01.000Z

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/b/3b54e9a53a19af6edd73ac58d5604eb4b753c0c1.png)

---

<div class="post-metadata">

**Author:** ![yuxiao](https://avatars.discourse-cdn.com/v4/letter/y/ad7895/32.png) [@yuxiao](https://discuss.elastic.co/u/yuxiao)\
**Post date:** [December 5, 2018, 9:03am UTC](https://discuss.elastic.co/t/logstash-date-issue/158465/7 "2018-12-05T09:03:53Z")

</div>

这个是官网的示例：[https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/6/06a5d7dc4e6c631e8b92632c323c04ad429ff3ab.png)

---

<div class="post-metadata">

**Author:** ![aabababba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aabababba/32/36732_2.png) [@aabababba](https://discuss.elastic.co/u/aabababba)\
**Post date:** [December 5, 2018, 9:31am UTC](https://discuss.elastic.co/t/logstash-date-issue/158465/8 "2018-12-05T09:31:07Z")

</div>

你原来日志时间格式是2018-11-16 08:00:01了？  
我用date插件也没成功。。。

---

<div class="post-metadata">

**Author:** ![yuxiao](https://avatars.discourse-cdn.com/v4/letter/y/ad7895/32.png) [@yuxiao](https://discuss.elastic.co/u/yuxiao)\
**Post date:** [December 5, 2018, 9:33am UTC](https://discuss.elastic.co/t/logstash-date-issue/158465/9 "2018-12-05T09:33:23Z")

</div>

准确点说 是的 但就是format失败 搞不懂了~~~ QQ: 396034282

---

<div class="post-metadata">

**Author:** ![yuxiao](https://avatars.discourse-cdn.com/v4/letter/y/ad7895/32.png) [@yuxiao](https://discuss.elastic.co/u/yuxiao)\
**Post date:** [December 5, 2018, 9:40am UTC](https://discuss.elastic.co/t/logstash-date-issue/158465/10 "2018-12-05T09:40:44Z")

</div>

其实，使用以下方式可以实现，但我觉得太过繁琐，应该在date中有什么更好的设置，但目前还没找到

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/7/471bc277202c7d2e8d085d3c46b2e4d185258629.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 2, 2019, 9:40am UTC](https://discuss.elastic.co/t/logstash-date-issue/158465/11 "2019-01-02T09:40:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.