# Logstash date timezone conversion

**URL:** https://discuss.elastic.co/t/logstash-date-timezone-conversion/174840
**Category:** Logstash
**Created:** [April 1, 2019, 6:30pm UTC](https://discuss.elastic.co/t/logstash-date-timezone-conversion/174840 "2019-04-01T18:30:56Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![paano](https://avatars.discourse-cdn.com/v4/letter/p/cab0a1/32.png) [@paano](https://discuss.elastic.co/u/paano)
#### Post date: [April 1, 2019, 6:30pm UTC](https://discuss.elastic.co/t/logstash-date-timezone-conversion/174840/1 "2019-04-01T18:30:56Z")

</div>

in the pipeline conf, used `timezone` but when viewing in kibana it converts to UTC time.

```auto
date {
  timezone => "America/Chicago"
	match => ["ALTDATE", "yyyy-MM-dd"]
	target => "ALTDATE"
}

date {
	match => ["CRDATE", "yyyy-MM-dd"]
	timezone => "America/Chicago"
	target => "CRDATE"
}

```

Partial rubydebug output as below.

```auto
elk_logstash | " ALTDATE" => "2013-05-24",
elk_logstash | "message" => "ALTDATE(2013-05-24), ALTTIME(14.45.03), CRDATE(2012-07-24), CRTIME(03.01.10)",
elk_logstash | "@version" => "1",
elk_logstash | "host" => {
elk_logstash | "name" => "5cd386e09087"
elk_logstash | },
lk_logstash | " CRDATE" => "2012-07-24",
elk_logstash | " CRTIME" => "03.01.10",
elk_logstash | "source" => "/var/log/test.log",
elk_logstash | "tags" => [],
elk_logstash | "@timestamp" => 2019-04-01T18:14:07.790Z,
elk_logstash | "offset" => 743,
elk_logstash | "input" => {
elk_logstash | "type" => "log"
elk_logstash | },
elk_logstash | "beat" => {
elk_logstash | "name" => "5cd386e09087",
elk_logstash | "version" => "6.5.2",
elk_logstash | "hostname" => "5cd386e09087"
elk_logstash | },
elk_logstash | " ALTTIME" => "14.45.03"
elk_logstash | }

```

We see logstash parses the data correctly.

Not able to understand why it fails to use the timezone for display.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 1, 2019, 7:05pm UTC](https://discuss.elastic.co/t/logstash-date-timezone-conversion/174840/2 "2019-04-01T19:05:14Z")

</div>

elasticsearch stores all dates/times as UTC. kibana typically shows dates in the browser's timezone but you can [tell it](https://www.elastic.co/guide/en/kibana/current/advanced-options.html) to use some other timezome using dateFormat:tz

---

<div class="post-metadata">

### Author: ![paano](https://avatars.discourse-cdn.com/v4/letter/p/cab0a1/32.png) [@paano](https://discuss.elastic.co/u/paano)
#### Post date: [April 1, 2019, 9:00pm UTC](https://discuss.elastic.co/t/logstash-date-timezone-conversion/174840/3 "2019-04-01T21:00:33Z")

</div>

@Badger Tried the option but did not work.  
Also tried "mutate -\> convert" but no luck.

Is there an alternative?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 1, 2019, 9:11pm UTC](https://discuss.elastic.co/t/logstash-date-timezone-conversion/174840/4 "2019-04-01T21:11:26Z")

</div>

You do not have fields called "ALTDATE" and "CRDATE". They are called " ALTDATE" and " CRDATE" with a leading space. So those date filters do nothing.

If you are using a kv filter you may need to add trim\_key to it.

---

<div class="post-metadata">

### Author: ![paano](https://avatars.discourse-cdn.com/v4/letter/p/cab0a1/32.png) [@paano](https://discuss.elastic.co/u/paano)
#### Post date: [April 1, 2019, 9:46pm UTC](https://discuss.elastic.co/t/logstash-date-timezone-conversion/174840/5 "2019-04-01T21:46:04Z")

</div>

Got it. tested after the trim and it worked.  
Did not know "a space in front of the key" would fail to parse.

It never threw any exception. Nice to know.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 29, 2019, 9:46pm UTC](https://discuss.elastic.co/t/logstash-date-timezone-conversion/174840/6 "2019-04-29T21:46:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
