# Logstash & KIbana timestamp indexing

**URL:** <https://discuss.elastic.co/t/logstash-kibana-timestamp-indexing/199929>\
**Category:** Logstash\
**Created:** [September 18, 2019, 7:22am UTC](https://discuss.elastic.co/t/logstash-kibana-timestamp-indexing/199929 "2019-09-18T07:22:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ALLAHshukur\_Ahmadzad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/allahshukur_ahmadzad/32/44720_2.png) [@ALLAHshukur\_Ahmadzad](https://discuss.elastic.co/u/ALLAHshukur_Ahmadzad)\
**Post date:** [September 18, 2019, 7:22am UTC](https://discuss.elastic.co/t/logstash-kibana-timestamp-indexing/199929/1 "2019-09-18T07:22:56Z")

</div>

Hi dear community.I am having problems with the index naming of logs that belongs to the one day but indexed as previous.Now the logs are like following:  
Log:  
09-09-2019 00:00:08 - log.....

Logstash output:  
output {  
elasticsearch {  
hosts =\> localhost  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"  
}  
}

Now if the log timestamp is something like "09-09-2019 10:00:08 - log...." then it is going to be indexed as "filebeat-7.3.1-2019.09.09" but if log datetime is something like "09-09-2019 00:00:08 ...log" or "09-09-2019 02:00:08 ...log" and so then it is going to be indexed like "filebeat-7.3.1-2019.09.08".

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 18, 2019, 12:44pm UTC](https://discuss.elastic.co/t/logstash-kibana-timestamp-indexing/199929/2 "2019-09-18T12:44:39Z")

</div>

elasticsearch timestamps, and the index names created from them, are based on UTC. For most people that means that events from a single day in local time will be split across two indexes.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 16, 2019, 12:44pm UTC](https://discuss.elastic.co/t/logstash-kibana-timestamp-indexing/199929/3 "2019-10-16T12:44:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.